CVE-2025-40360

What it actually does

NULL pointer dereference in __drm_gem_reset_shadow_plane() when plane state is NULL, allowing invalid memory access during DRM plane reset operations in the Linux kernel.

Why it matters to the business

Kernel crashes or system instability on affected Red Hat Enterprise Linux systems using DRM graphics subsystems, potentially causing downtime for workloads reliant on display or GPU functionality; widespread kernel package exposure increases patch urgency across enterprise deployments.

How an attack unfolds

An attacker with local access triggers DRM operations that invoke plane reset with a NULL plane state, causing the kernel to dereference the pointer and resulting in a crash or memory corruption opportunity.

How to fix it

Upgrade all listed affected Red Hat rhel_e4s:8.0 kernel packages to version 0:4.18.0-80.23.2.el8_0 or later; apply the fix that passes NULL through reset helpers without dereference and clears plane->state.

How to confirm the fix worked

Confirm kernel package versions match or exceed the fixed release; test DRM plane reset paths in controlled environments to verify no NULL dereference occurs; review kernel logs for absence of related oops or panic messages post-upgrade.

Typical attack path

1. Obtain local user access on a vulnerable system
2. Craft or trigger specific DRM sysfb plane reset calls
3. Cause __drm_gem_reset_shadow_plane to receive NULL state
4. Induce NULL dereference leading to kernel panic or corruption

How to detect it

Review kernel logs and dmesg for NULL pointer dereference oops in drm or sysfb functions; inspect system call traces involving DRM plane resets for anomalous activity.

What your security team should do

• Prioritize kernel updates on all rhel_e4s:8.0 systems within standard change windows
• Monitor for any downstream dependents using these kernel builds
• Restrict unprivileged local access where possible until patched