CVE-2025-40354: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40354 is a NULL pointer dereference vulnerability in the Linux kernel's DRM/AMD display subsystem (drm/amd/display). It involves two related issues: an undersized dc->links[MAX_LINKS] array (12 entries instead of the required 14) and a NULL pointer dereference in hw_init() when accessing LINK_ENC for DPIA non-display endpoints. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.00017 (very low), and no CVSS score has been formally assigned (Feedly, EUVD).

The root cause is a combination of an out-of-bounds array sizing error (CWE-131: Incorrect Calculation of Buffer Size) and a NULL pointer dereference (CWE-476). The dc->links array was allocated with MAX_LINKS = 12, but the actual maximum required is max_connector + max_dpia + 4 virtual = 14, meaning array accesses beyond index 11 could corrupt adjacent memory. Additionally, hw_init() unconditionally accesses link->enc for DPIA links that are not display endpoints, where link->enc is NULL, triggering a kernel NULL pointer dereference. The fix increases MAX_LINKS to 14 and adds a guard to skip NULL LINK_ENC access for non-display DPIA endpoints, cherry-picked from upstream commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45 (Feedly, EUVD).

Exploitation of this vulnerability can cause a kernel NULL pointer dereference, resulting in a kernel panic (system crash) and denial of service on affected Linux systems with AMD GPUs that use DPIA (DisplayPort Input Adapter) links. The array undersizing could also lead to out-of-bounds memory access, potentially corrupting kernel memory structures. The impact is primarily an availability concern (system crash), with limited confidentiality or integrity risk in typical exploitation scenarios (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2025-40354. The EPSS score is approximately 0.00017, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with an affected AMD GPU configuration, further limiting practical risk (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.12.56, 6.17.6, and 6.18 (mainline). The fixes are available via the stable kernel git repository at the referenced commits. Users running affected kernel versions with AMD GPUs should update to a patched kernel release. No configuration-based workaround is available; upgrading is the recommended remediation (EUVD, Kernel Stable).