CVE-2025-38361

drm/amd/display: Check dce_hwseq before dereferencing it

HIGH
7.8
CVSS Score
Published: July 25, 2025 at 12:47 PM UTC
Updated: June 17, 2026 at 09:16 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check dce_hwseq before dereferencing it [WHAT] hws was checked for null earlier in dce110_blank_stream, indicating hws can be null, and should be checked whenever it is used. (cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.15 ≤ v < 6.1.1624.15 ≤ v < 6.12.364.15 ≤ v < 6.15.54.15 ≤ v < 6.164.15 ≤ v < 6.6.1226.13 ≤ v < 6.15.54.154562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c6.16 rc16.16 rc2
Vendor states this is fixed in 5e1482ae14b03b9fca73ef5afea26ede683f4450 (fixed)
Vendor states this is fixed in 60e450eec5d63113c6ad5c456ce64c12b4496a6e (fixed)
Vendor states this is fixed in b669507b637eb6b1aaecf347f193efccc65d756e (fixed)
Vendor states this is fixed in df11bf0ef795b6d415c4d8ee54fa3f2105e75bcb (fixed)
Vendor states this is fixed in e881b82f5d3d8d54d168cd276169f0fee01bf0e7 (fixed)
Vendor states this is fixed in 4.15 (unaffected)
Vendor states this is fixed in 6.1.162 (unaffected)
Vendor states this is fixed in 6.12.36 (unaffected)
Vendor states this is fixed in 6.15.5 (unaffected)
Vendor states this is fixed in 6.16 (unaffected)
Vendor states this is fixed in 6.6.122 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card