CVE-2025-39807

What it actually does

NULL pointer dereference in mtk_crtc_plane_disable when old_state->crtc is NULL after hotplug events during cursor updates in the Mediatek DRM atomic commit path.

Why it matters to the business

Kernel panics on affected Linux systems using Mediatek display hardware can cause sudden reboots, service outages, and loss of container workloads; widespread kernel prevalence increases exposure across servers and embedded devices.

How an attack unfolds

An attacker with local access triggers display hotplug or cursor ioctl operations that reach drm_atomic_helper_update_plane without a valid CRTC state, dereferencing NULL and crashing the kernel; named actors such as VMSCAPE have targeted similar Linux kernel privilege-escalation paths in container-optimized environments.

How to fix it

Upgrade Linux kernel to 6.12.45 or apply commit 7d5cc22efa44e0fe321ce195c71c3d7da211fbb2; Debian evolution packages to 1.3.2 where applicable; reboot after update and verify no cursor-related panics occur post-hotplug.

How to confirm the fix worked

Confirm running kernel version is at or above 6.12.45, inspect dmesg for absence of mtk_crtc_plane_disable NULL dereference traces, and test hotplug plus cursor operations to ensure stability.

Typical attack path

1. Obtain local user or container access on affected Linux kernel
2. Trigger hotplug event or issue drm_mode_cursor_ioctl
3. Force atomic plane update path that passes stale NULL old_state->crtc
4. Execute mtk_crtc_plane_disable on invalid pointer
5. Cause NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference messages referencing mtk_crtc_plane_disable, mtk_plane_atomic_update, or drm_atomic_helper_commit_planes after hotplug events; correlate with container privilege-escalation attempts noted by VMSCAPE.

• Unable to handle kernel NULL pointer dereference at virtual address
• mtk_crtc_plane_disable+0x24/0x140
• mtk_plane_atomic_update+0x8c/0xa8
• drm_mode_cursor_ioctl+0x44/0x70

What your security team should do

• Prioritize kernel upgrade to 6.12.45 or patched commit within maintenance windows given 406 days since publication
• Monitor EPSS trend and container environments for similar privilege-escalation attempts
• Add kernel panic logging and alerting for drm atomic commit failures
• Restrict unprivileged access to DRM ioctls where feasible