Listen to this Post
How the CVE Works:
This vulnerability exists in the MediaTek Direct Rendering Manager (DRM) driver within the Linux kernel. During an atomic display update, the `mtk_crtc_plane_disable()` function accesses the `old_state->crtc` pointer without validation. A specific sequence involving a display hotplug event can leave this state object NULL while the cursor continues to update. When the driver attempts to dereference this NULL pointer to access CRTC (Cathode Ray Tube Controller) properties, it triggers a kernel panic, crashing the entire system. The crash occurs because the code path `drm_mode_cursor_ioctl -> drm_atomic_helper_update_plane -> mtk_plane_atomic_update -> mtk_crtc_plane_disable` does not handle the case where the old CRTC state is absent after a hotplug. The patch adds a simple NULL check before using the pointer.
DailyCVE Form:
Platform: Linux Kernel
Version: MediaTek DRM driver
Vulnerability: NULL Pointer Dereference
Severity: Critical
Date: 2025-09-16
Prediction: 2025-10-14
What Undercode Say:
Analytics:
`uname -r`
`grep -i mediatek /proc/version`
`lsmod | grep mediatek`
`dmesg | tail -50`
How Exploit:
Trigger display hotplug.
Rapid cursor updates.
Kernel NULL dereference.
System panic/crash.
Protection from this CVE:
Apply kernel patch.
Update Linux kernel.
Disable affected driver.
Impact:
Kernel Panic
Denial-of-Service
System Crash
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
