// For flags

CVE-2025-38240

drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr

Severity Score

5.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the
`mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach().
Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL
pointer dereference. Change the error message directly in
mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the
error messages in mtk_dp_parse_capabilities(), which is called by
mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make
future debugging easier.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/mediatek: dp: drm_err => dev_err en la ruta HPD para evitar un puntero nulo. La función mtk_dp_wait_hpd_asserted() puede llamarse antes de asignar el puntero `mtk_dp->drm_dev` en mtk_dp_bridge_attach(). Específicamente, se puede llamar a través de esta ruta de llamada: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe El uso de impresiones de nivel "drm" en cualquier parte de esta ruta de llamada provoca una desreferencia del puntero nulo. Cambie el mensaje de error directamente en mtk_dp_wait_hpd_asserted() a dev_err() para evitar esto. Cambie también los mensajes de error en mtk_dp_parse_capabilities(), que es llamado por mtk_dp_wait_hpd_asserted(). Al tocar estas impresiones, agregue también el código de error para facilitar la depuración futura.

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make future debugging easier.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2025-04-16 CVE Reserved
  • 2025-04-18 CVE Published
  • 2025-05-20 EPSS Updated
  • 2025-05-26 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 6.6 < 6.6.87
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.6.87"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 6.6 < 6.12.23
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.12.23"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 6.6 < 6.13.11
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.13.11"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 6.6 < 6.14.2
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.14.2"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 6.6 < 6.15
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6 < 6.15"
en
Affected