Null Pointer Dereference Vulnerability in Linux Kernel (CVE-2025-38362)
Summary
CVE-2025-38362: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check for get_first_active_display() The function mod_hdcp_hdcp1_enable_encryption() calls the function get_first_acti... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2025-38362 affects the display management functions within the kernel, particularly in the AMD display driver, which is responsible for managing graphics output.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver where the function mod_hdcp_hdcp1_enable_encryption() calls get_first_active_display() without checking its return value. If the display list is empty, this function returns a null pointer, leading to a null pointer dereference in mod_hdcp_hdcp2_enable_encryption(). This flaw can cause system crashes or unexpected behavior, potentially impacting users relying on graphical output.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-38362 is a significant vulnerability in the Linux kernel affecting the AMD display driver, leading to potential system instability. It is essential to update to the patched version to ensure system security and reliability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38362 is a vulnerability in the Linux kernel related to a null pointer dereference in the AMD display driver.
This vulnerability can lead to system crashes or unexpected behavior, particularly affecting users who rely on graphical output.
Yes, a patched version of the Linux package is available for Debian 13, specifically version 6.12.37-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the manifest file like package-lock.json, it can help identify if your application is affected by this vulnerability.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
