CVE-2025-38361: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38361 is a null pointer dereference vulnerability in the Linux kernel's AMD display driver (drm/amd/display). The flaw exists because the dce_hwseq pointer (hws) is checked for null in dce110_blank_stream but is not consistently validated before being dereferenced in other code paths. Affected kernel versions include 4.15 through 6.12.35 and 6.13 through 6.15.4, as well as pre-release versions 6.16-rc1 and 6.16-rc2. It was published on July 25, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, EUVD).

The root cause is a null pointer dereference (CWE-476) in the drm/amd/display subsystem of the Linux kernel. The hws (dce_hwseq) pointer is conditionally checked for null in dce110_blank_stream, establishing that it can be null, but other code paths that use hws omit this check, allowing a null dereference to occur. Exploitation requires local access with low-level user privileges and no user interaction. The fix, cherry-picked from upstream commit 79db43611ff61280b6de58ce1305e0b2ecf675ad, adds the missing null check before each dereference of hws (Feedly, Kernel Patch).

A local attacker with low-level privileges can trigger a kernel panic (denial of service) or potentially achieve arbitrary code execution with kernel privileges by exploiting the null pointer dereference. The vulnerability affects system confidentiality, integrity, and availability — all rated High in the CVSS assessment. Systems running AMD GPUs with the affected display driver are at risk, and successful exploitation could enable privilege escalation or persistent kernel-level access (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Update the Linux kernel to a patched version: 6.12.36 or later (for the 4.15–6.12.x branch), 6.15.5 or later (for the 6.13–6.15.x branch), or 6.16-rc3 or later (for pre-release users). Patch commits are available at the kernel stable repository. As a temporary measure, restrict local user access on systems with AMD GPUs to reduce the attack surface until patching is feasible (Feedly, Kernel Patch). Ubuntu and SUSE have issued distribution-specific kernel updates addressing this CVE (Ubuntu USN-7834-1, SUSE Advisory).

The vulnerability has been addressed in downstream distributions including Ubuntu (USN-7834-1), SUSE (multiple advisories), and Debian (DSA-6127-1 and DLA-4476-1), indicating broad distribution-level attention. No notable individual researcher commentary or significant social media discussion has been identified beyond standard patch tracking (Ubuntu USN-7834-1, SUSE Advisory, Debian LTS).