CVE-2025-38363: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38363 is a NULL pointer dereference vulnerability in the Linux kernel's drm/tegra DRM driver, specifically within the tegra_crtc_reset() function. The flaw arises because memory allocated via kzalloc() is not validated before being passed to __drm_atomic_helper_crtc_reset(), potentially triggering a kernel crash. It affects Linux kernel versions from 5.3 through multiple stable branches, with fixed versions including 5.10.240, 5.15.187, 6.1.143, 6.6.96, 6.12.36, and 6.15.5. Disclosed on July 25, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In tegra_crtc_reset(), the kernel allocates a new CRTC state structure using kzalloc(), but does not check whether the allocation succeeded before passing the pointer to __drm_atomic_helper_crtc_reset(). If kzalloc() returns NULL due to memory pressure, the subsequent dereference of the NULL pointer causes a kernel panic. Exploitation requires local access with low privileges, as an attacker would need to trigger conditions that cause memory allocation failure in the drm/tegra subsystem (Red Hat CVE, Feedly).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems include those running vulnerable Linux kernel versions with NVIDIA Tegra-based DRM hardware, such as certain embedded and ARM-based platforms (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term (Feedly).

Update to a patched Linux kernel version: 5.10.240, 5.15.187, 6.1.143, 6.6.96, 6.12.36, or 6.15.5 (and later). Ubuntu has issued security notices USN-7774-1, USN-7775-1, USN-7776-1, USN-7774-5, USN-7833-1 through USN-7833-4 addressing this vulnerability. As a workaround, restricting local user access to minimize the attack surface and implementing kernel module loading controls can reduce exposure until patching is feasible (Red Hat CVE, Ubuntu USN-7774-1, Ubuntu USN-7833-1).