CVE-2025-38362: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38362 is a vulnerability discovered in the Linux kernel's AMD display driver component, specifically in the drm/amd/display subsystem. The vulnerability was disclosed on July 25, 2025, and affects the handling of display list checks in the HDCP encryption functionality (NVD, Red Hat).

The vulnerability stems from a missing null pointer check in the modhdcphdcp1enableencryption() function when it calls getfirstactivedisplay(). When the display list is empty, getfirstactivedisplay() returns a null pointer, which is not properly validated, leading to a null pointer dereference in modhdcphdcp2enableencryption(). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a moderate severity level (Red Hat).

The vulnerability can lead to a null pointer dereference in the kernel's AMD display driver, potentially causing system crashes or denial of service conditions when the HDCP encryption functionality is utilized with an empty display list (NVD).

The fix involves adding a null pointer check for getfirstactivedisplay() and returning MODHDCPSTATUSDISPLAYNOTFOUND if the function returns null. This patch has been implemented in the Linux kernel (NVD).