CVE-2025-38597

What it actually does

Null pointer dereference in drm/rockchip vop2 driver during video port binding when no usable primary plane is found for a port (e.g., rk3576 vp2 with vp0 active), causing kernel crash on probe.

Why it matters to the business

Graphics initialization failures or system crashes on affected Rockchip hardware can lead to boot issues, reduced availability, and operational disruptions in embedded or containerized Linux environments using the vulnerable kernel.

How an attack unfolds

An attacker with local access triggers vop2 driver binding under conditions where a primary plane is absent for the target video port, resulting in the unchecked null dereference during drm_crtc_init_with_planes and kernel panic; listed actors such as VMSCAPE have been associated with similar Linux kernel privilege escalation attempts on container-optimized OS.

How to fix it

Update Linux kernel to commit e1eef239399927b368f70a716044fb10085627c8 or later; for Chainguard packages update openjdk-17-openj9 variants to 0.53.0-r0; rebuild and redeploy images with fixed kernel; verify probe succeeds with primary plane present on target ports.

How to confirm the fix worked

Confirm kernel version includes the check at end of window iteration that fails probe cleanly if no primary plane found; test binding on rk3576 with vp0 active to ensure no null dereference occurs.

Typical attack path

1. Obtain local execution or container access on affected Linux kernel with Rockchip VOP2 hardware.
2. Ensure configuration where vp0 is active and vp2 lacks a usable primary window.
3. Trigger device probe or graphics subsystem initialization to reach window iteration without primary plane check.
4. Cause null pointer dereference leading to kernel panic or denial of service.

How to detect it

Review kernel logs for null pointer dereference or oops during drm/rockchip vop2 probe; search dmesg or journalctl for vop2 binding failures on rk3576 or similar ports; correlate with container startup events on affected kernels.

What your security team should do

• Prioritize kernel updates on all Rockchip-based systems within 30 days given EPSS upward trend.
• Audit container images for vulnerable openjdk-17-openj9 packages and rebuild with fixed versions.
• Monitor for kernel oops or panic logs during graphics probe on affected SoCs.
• Disable unused video ports where possible until patched.