CVE-2025-21941: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21941 is a vulnerability discovered in the Linux kernel affecting the AMD display driver component. The vulnerability was identified through code review and disclosed on April 1, 2025. It affects multiple versions of the Linux kernel from version 4.15 up to versions prior to 6.14-rc6 (NVD).

The vulnerability is a NULL Pointer Dereference (CWE-476) in the drm/amd/display component, specifically in the resourcebuildscalingparams function. The issue occurs when pipectx->plane_state is null and is accessed without proper validation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a null pointer dereference, which could result in a system crash or denial of service condition. The CVSS scoring indicates that while the vulnerability requires local access and low privileges, it can have a high impact on system availability (NVD).

The vulnerability has been fixed in multiple kernel versions. Fixed versions include Linux kernel 6.1.133-1 for Debian bookworm, 6.12.21-1 for Debian trixie, and 6.12.22-1 for Debian sid. The fix adds a proper null check to ensure 'pipectx->planestate' is validated before access (Debian).