Critical NULL Pointer Dereference in Linux Kernel - CVE-2025-22093
Summary
CVE-2025-22093: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid NPD when ASIC does not support DMUB ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_i... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2025-22093, which affects the AMD display driver within the kernel. This vulnerability can lead to system crashes and instability, particularly in systems that do not support DMUB (Display Microcontroller Unit Bootloader).
Vulnerability Detail
CVE-2025-22093 is a vulnerability in the Linux kernel's AMD display driver that results from a NULL pointer dereference. The issue occurs when the system attempts to access the dmub_srv context, which can be NULL if the ASIC does not support DMUB. This dereference leads to a kernel panic, causing the system to crash. The vulnerability has existed since the introduction of DMUB support for PSR1 and can affect systems running the kernel version 6.14.0-rc1 and potentially others.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to update to the patched version of the Linux kernel as soon as it becomes available.
Conclusion
CVE-2025-22093 is a critical vulnerability in the Linux kernel that can lead to system crashes due to a NULL pointer dereference in the AMD display driver. Users are advised to update their systems to the latest kernel version to protect against this issue. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22093 is a vulnerability in the Linux kernel's AMD display driver that can cause a system crash due to a NULL pointer dereference.
If your system's hardware does not support DMUB, this vulnerability can lead to kernel panics and instability, potentially causing data loss.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
Yes, a patch is expected to be included in future updates of the Linux kernel. Users should regularly check for updates to ensure they are protected.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
