CVE-2025-40148: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40148 was disclosed on November 12, 2025, affecting the Linux kernel's AMD display driver. The vulnerability involves missing NULL pointer checks in the dcstream cursor attribute functions, specifically in the dcstreamsetcursor_attributes() function which dereferences the stream pointer and nested members without proper validation (NVD).

The vulnerability exists in the drm/amd/display component where the dcstreamsetcursorattributes() function performs unchecked dereferencing of the stream pointer and its nested members stream->ctx->dc->current_state. While all callers of these functions, such as dcn30_apply_idle_power_optimizations() and amdgpu_dm_plane_handle_cursor_update(), implement NULL checks before invocation, the function itself lacks proper validation (NVD).

A NULL pointer dereference in the AMD display driver could potentially lead to system crashes or denial of service conditions when processing cursor attributes in affected Linux kernel versions (NVD).

The vulnerability has been addressed by adding NULL pointer checks in the dc_stream cursor attribute functions. The fix involves implementing proper validation before dereferencing the stream pointer and its nested members (NVD).