CVE-2025-38205: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38205 is a divide-by-zero vulnerability in the Linux kernel's AMD display driver (drm/amd/display) where uninitialized dummy pitch values in the populate_dummy_dml_surface_cfg() function can trigger a divide-by-zero error in downstream callers such as CalculateVMAndRowBytes(). It affects Linux kernel versions from 6.7 up to (but not including) 6.15.4. The vulnerability was published on July 4, 2025, and patches were added to the stable kernel tree on November 18, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-369 (Divide By Zero). When populate_dummy_dml_surface_cfg() is called but its dummy surface configuration values are not subsequently updated, the uninitialized pitch value of zero is passed to downstream display model logic functions such as CalculateVMAndRowBytes(), which perform arithmetic division using that value, resulting in a kernel divide-by-zero fault. The fix initializes the dummy pitch to 1 to prevent the zero-divisor condition. Exploitation requires local access with low privileges and no user interaction (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel divide-by-zero fault, leading to system instability or a kernel panic, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability is confined to systems running AMD GPUs with the affected display subsystem code, and there is no evidence of lateral movement potential or data exposure risk (Feedly).

Update to Linux kernel version 6.15.4 or later, which includes the fix that initializes the dummy pitch value to 1 in populate_dummy_dml_surface_cfg(). Two upstream patches are available in the stable kernel tree. Distribution-specific updates have been issued by Ubuntu (USN-7833-1, USN-7833-2, USN-7833-3, USN-7833-4, USN-7856-1) and SUSE/openSUSE. Users should apply the relevant vendor kernel update for their distribution and verify system stability after patching (Feedly, Ubuntu USN-7833-1, Ubuntu USN-7856-1).