GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38240 (GCVE-0-2025-38240)

Vulnerability from cvelistv5 – Published: 2025-04-18 07:01 – Updated: 2026-05-11 21:23
VLAI
Title
drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make future debugging easier.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7eacba9a083be65c0f251c19380ec01147c01ebc , < 13ec849fd2eab808ee8eba2625df7ebea3b85edf (git)
Affected: 7eacba9a083be65c0f251c19380ec01147c01ebc , < 57a9fb47551b33cde7b76d17c0072c3b394f4620 (git)
Affected: 7eacba9a083be65c0f251c19380ec01147c01ebc , < 2fda391ef7a701748abd7fa32232981b522c1e07 (git)
Affected: 7eacba9a083be65c0f251c19380ec01147c01ebc , < 149a5c38436c229950cf1020992ce65c9549bc19 (git)
Affected: 7eacba9a083be65c0f251c19380ec01147c01ebc , < 106a6de46cf4887d535018185ec528ce822d6d84 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.87 , ≤ 6.6.* (semver)
Unaffected: 6.12.23 , ≤ 6.12.* (semver)
Unaffected: 6.13.11 , ≤ 6.13.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13ec849fd2eab808ee8eba2625df7ebea3b85edf",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "57a9fb47551b33cde7b76d17c0072c3b394f4620",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "2fda391ef7a701748abd7fa32232981b522c1e07",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "149a5c38436c229950cf1020992ce65c9549bc19",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "106a6de46cf4887d535018185ec528ce822d6d84",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr\n\nThe function mtk_dp_wait_hpd_asserted() may be called before the\n`mtk_dp-\u003edrm_dev` pointer is assigned in mtk_dp_bridge_attach().\nSpecifically it can be called via this callpath:\n - mtk_edp_wait_hpd_asserted\n - [panel probe]\n - dp_aux_ep_probe\n\nUsing \"drm\" level prints anywhere in this callpath causes a NULL\npointer dereference. Change the error message directly in\nmtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the\nerror messages in mtk_dp_parse_capabilities(), which is called by\nmtk_dp_wait_hpd_asserted().\n\nWhile touching these prints, also add the error code to them to make\nfuture debugging easier."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:23:56.828Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13ec849fd2eab808ee8eba2625df7ebea3b85edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/57a9fb47551b33cde7b76d17c0072c3b394f4620"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fda391ef7a701748abd7fa32232981b522c1e07"
        },
        {
          "url": "https://git.kernel.org/stable/c/149a5c38436c229950cf1020992ce65c9549bc19"
        },
        {
          "url": "https://git.kernel.org/stable/c/106a6de46cf4887d535018185ec528ce822d6d84"
        }
      ],
      "title": "drm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38240",
    "datePublished": "2025-04-18T07:01:32.338Z",
    "dateReserved": "2025-04-16T04:51:23.996Z",
    "dateUpdated": "2026-05-11T21:23:56.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38240",
      "date": "2026-09-15",
      "epss": "0.00263",
      "percentile": "0.18257"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38240\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-18T07:15:43.510\",\"lastModified\":\"2026-06-17T09:16:27.637\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr\\n\\nThe function mtk_dp_wait_hpd_asserted() may be called before the\\n`mtk_dp-\u003edrm_dev` pointer is assigned in mtk_dp_bridge_attach().\\nSpecifically it can be called via this callpath:\\n - mtk_edp_wait_hpd_asserted\\n - [panel probe]\\n - dp_aux_ep_probe\\n\\nUsing \\\"drm\\\" level prints anywhere in this callpath causes a NULL\\npointer dereference. Change the error message directly in\\nmtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the\\nerror messages in mtk_dp_parse_capabilities(), which is called by\\nmtk_dp_wait_hpd_asserted().\\n\\nWhile touching these prints, also add the error code to them to make\\nfuture debugging easier.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/mediatek: dp: drm_err =\u0026gt; dev_err en la ruta HPD para evitar un puntero nulo. La funci\u00f3n mtk_dp_wait_hpd_asserted() puede llamarse antes de asignar el puntero `mtk_dp-\u0026gt;drm_dev` en mtk_dp_bridge_attach(). Espec\u00edficamente, se puede llamar a trav\u00e9s de esta ruta de llamada: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe El uso de impresiones de nivel \\\"drm\\\" en cualquier parte de esta ruta de llamada provoca una desreferencia del puntero nulo. Cambie el mensaje de error directamente en mtk_dp_wait_hpd_asserted() a dev_err() para evitar esto. Cambie tambi\u00e9n los mensajes de error en mtk_dp_parse_capabilities(), que es llamado por mtk_dp_wait_hpd_asserted(). Al tocar estas impresiones, agregue tambi\u00e9n el c\u00f3digo de error para facilitar la depuraci\u00f3n futura.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/mediatek/mtk_dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7eacba9a083be65c0f251c19380ec01147c01ebc\",\"lessThan\":\"13ec849fd2eab808ee8eba2625df7ebea3b85edf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eacba9a083be65c0f251c19380ec01147c01ebc\",\"lessThan\":\"57a9fb47551b33cde7b76d17c0072c3b394f4620\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eacba9a083be65c0f251c19380ec01147c01ebc\",\"lessThan\":\"2fda391ef7a701748abd7fa32232981b522c1e07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eacba9a083be65c0f251c19380ec01147c01ebc\",\"lessThan\":\"149a5c38436c229950cf1020992ce65c9549bc19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eacba9a083be65c0f251c19380ec01147c01ebc\",\"lessThan\":\"106a6de46cf4887d535018185ec528ce822d6d84\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/mediatek/mtk_dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.87\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.23\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.11\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.87\",\"matchCriteriaId\":\"DF08B6FA-567C-416D-8919-C3B544FF0DFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.23\",\"matchCriteriaId\":\"26CAB76D-F00F-43CE-BEAD-7097F8FB1D6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.11\",\"matchCriteriaId\":\"E7E864B0-8C00-4679-BA55-659B4C9C3AD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"FADAE5D8-4808-442C-B218-77B2CE8780A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/106a6de46cf4887d535018185ec528ce822d6d84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13ec849fd2eab808ee8eba2625df7ebea3b85edf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/149a5c38436c229950cf1020992ce65c9549bc19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fda391ef7a701748abd7fa32232981b522c1e07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/57a9fb47551b33cde7b76d17c0072c3b394f4620\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:20+00:00",
      "cve": "CVE-2025-38240",
      "id": "CVE-2025-38240",
      "initial_release_date": "2025-04-18T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38240.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:48:25Z",
      "cve": "CVE-2025-38240",
      "id": "CVE-2025-38240",
      "initial_release_date": "2025-04-18T23:19:07Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "408",
      "product_status:recommended": "396",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38240",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38240.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.