Critical Null Pointer Dereference in Linux Kernel - CVE-2025-38363
Summary
CVE-2025-38363: In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix a possible null pointer dereference In tegra_crtc_reset(), new memory is allocated with kzalloc(), but no check is performed. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing the essential interface between hardware and software. It is known for its stability, performance, and flexibility, supporting a wide range of devices and architectures. However, vulnerabilities can arise, such as CVE-2025-38363, which affects the kernel's graphics driver for NVIDIA Tegra devices, potentially leading to system instability.
Vulnerability Detail
CVE-2025-38363 is a vulnerability in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically within the Tegra graphics driver. The issue stems from a lack of null pointer checks after memory allocation using kzalloc() in the tegra_crtc_reset() function. If the allocated memory is null, subsequent calls to __drm_atomic_helper_crtc_reset could lead to a null pointer dereference, causing a crash or undefined behavior in the system. This vulnerability can compromise system stability and security, making it critical to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality until the patch is applied. However, it is highly recommended to apply the update as soon as possible to mitigate risks associated with this vulnerability.
Conclusion
CVE-2025-38363 is a critical vulnerability in the Linux kernel that requires immediate attention. By updating to the patched version of the Linux package, users can protect their systems from potential crashes and instability. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38363 is a vulnerability in the Linux kernel's Tegra graphics driver that can lead to a null pointer dereference, potentially causing system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability could lead to system instability, crashes, or undefined behavior, impacting the overall performance and security of the system.
Yes, a patch is available for Debian 13 in version 6.12.37-1. Users should update their kernel package to this version to resolve the issue.
You can use Vulert to monitor your applications for vulnerabilities in real-time. It provides alerts based on your manifest files, ensuring you are always aware of potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
