CVE-2025-39807: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39807 is a vulnerability discovered in the Linux kernel's DRM (Direct Rendering Manager) MediaTek driver, specifically in the CRTC (CRT Controller) atomic disable functionality. The vulnerability was disclosed on September 16, 2025, affecting the Linux kernel's display subsystem (NVD, RedHat).

The vulnerability occurs in the drm/mediatek component where, after a hotplug event, the cursor continues to update, leading to a NULL pointer dereference when accessing old_state->crtc. This results in a kernel panic. The issue has been assigned a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity (RedHat).

The vulnerability can lead to a kernel panic due to NULL pointer dereference, potentially causing system crashes and denial of service conditions. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (RedHat).

The vulnerability has been addressed by adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state. The fix has been included in Linux kernel version 6.12.48-1 for Debian's stable distribution (trixie) (Debian).