CVE-2025-38467

What it actually does

Race condition in DRM Exynos IRQ handler allows NULL pointer dereference when drm_crtc_handle_vblank is called without first validating that the device can handle vblanks.

Why it matters to the business

Kernel panic on boot in systems using serial or alternate consoles leads to repeated boot failures and downtime; low urgency given no KEV listing, low EPSS with modest upward trend, and 459 days since publication despite listed threat actor activity around related kernel issues.

How an attack unfolds

Attacker configures a system with an alternate console such as TTY serial to trigger the race during early boot IRQ handling; may be leveraged within campaigns involving listed Linux kernel privilege escalation techniques from Advanced Spyware Campaign or related CVEs.

How to fix it

Upgrade aide packages on Debian 11 to 0.17.3-4+deb11u3, on Debian 12 to 0.18.3-1+deb12u4, on Debian 13 to 0.19.1-2+deb13u1, and aide from GIT to commit 09bfeb7f91dacd9834f458f5712dfeac2606fc85; apply equivalent kernel patch adding the vblank validation check.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases, enable serial console, and verify clean boot without the NULL dereference panic in drm_crtc_handle_vblank.

Typical attack path

1. Configure target with serial console or alternate console device
2. Initiate boot sequence to reach decon IRQ handler
3. Exploit missing vblank check to dereference NULL pointer and induce panic or follow-on exploitation

How to detect it

Search kernel logs and boot traces for the panic strings and call stack frames involving drm_crtc_handle_vblank and decon_irq_handler; correlate with systems having serial console configurations.

• Unable to handle kernel NULL pointer dereference at virtual address 000000000000000
• drm_crtc_handle_vblank+0x10/0x30
• decon_irq_handler+0x88/0xb4

What your security team should do

• Prioritize patching aide and kernel components to the exact fixed versions provided
• Test boot behavior with alternate consoles enabled
• Monitor EPSS trend and related privilege-escalation actor activity for any change in risk