CVE-2025-38705

What it actually does

Null pointer dereference in the AMD power management driver triggered by writing delimiter-free strings to gpu_od/fan_ctrl or pp_power_profile_mode sysfs entries for the CUSTOM profile, causing kernel memory corruption.

Why it matters to the business

Unexpected system crashes or kernel panics on affected Linux systems can cause downtime, data loss, and service disruption; in some environments this may be leveraged for local privilege escalation.

How an attack unfolds

An attacker with local access writes a string lacking spaces, newlines, or null terminators to the vulnerable sysfs paths; the kernel code fails to handle the missing delimiter and dereferences a null pointer, resulting in a crash or memory corruption that can be chained for code execution.

How to fix it

Update the Linux kernel to a version containing commit a83ffafd02a7af59848755c109d544e3894af737 or later stable releases that include the null-pointer fix in drm/amd/pm.

How to confirm the fix worked

Verify the running kernel contains commit a83ffafd02a7af59848755c109d544e3894af737; attempt controlled writes to the sysfs paths in a test environment and confirm absence of dereference faults in dmesg.

Typical attack path

1. Obtain local shell or unprivileged user access on a Linux system with AMD GPU drivers
2. Locate and write a malformed string without delimiters to /sys/class/drm/card*/device/gpu_od/fan_ctrl or pp_power_profile_mode while the CUSTOM profile is active
3. Trigger the null pointer dereference to induce a kernel oops or panic
4. If the corruption is exploitable, chain into arbitrary code execution for privilege escalation

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing amd/pm, drm, gpu_od/fan_ctrl, or pp_power_profile_mode around the time of unexpected reboots.

• gpu_od/fan_ctrl
• pp_power_profile_mode
• null pointer dereference
• amd/pm

What your security team should do

• Prioritize kernel updates on all AMD GPU-equipped Linux hosts within the next maintenance window
• Restrict write access to the affected sysfs entries via file permissions or SELinux/AppArmor policies where possible
• Monitor kernel logs for amd/pm or drm-related null pointer dereference messages