{
  "cveId": "CVE-2025-40148",
  "url": "https://patchblox.com/security/cve/CVE-2025-40148",
  "summary": "CVE-2025-40148 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40148 (version 6.17.6-1), released November 12, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add NULL pointer checks in dc_s...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions  The function dc_stream_set_cursor_attributes() currently dereferences the \u0060stream\u0060 pointer and nested members \u0060stream-\u003Ectx-\u003Edc-\u003Ecurrent_state\u0060 without checking for NULL.  All callers of these functions, such as in \u0060dcn30_apply_idle_power_optimizations()\u0060 and \u0060amdgpu_dm_plane_handle_cursor_update()\u0060, already perform NULL checks before calling these functions.  Fixes below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() error: we previously assumed \u0027stream\u0027 could be null (see line 334)  drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c     327 bool dc_stream_program_cursor_attributes(     328         struct dc_stream_state *stream,     329         const struct dc_cursor_attributes *attributes)     330 {     331         struct dc  *dc;     332         bool reset_idle_optimizations = false;     333     334         dc = stream ? stream-\u003Ectx-\u003Edc : NULL;                      ^^^^^^ The old code assumed stream could be NULL.      335 --\u003E 336         if (dc_stream_set_cursor_attributes(stream, attributes)) {                                                     ^^^^^^ The refactor added an unchecked dereference.  drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c    313  bool dc_stream_set_cursor_attributes(    314          struct dc_stream_state *stream,    315          const struct dc_cursor_attributes *attributes)    316  {    317          bool result = false;    318    319          if (dc_stream_check_cursor_attributes(stream, stream-\u003Ectx-\u003Edc-\u003Ecurrent_state, attributes)) {                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. This function used to check for if stream as NULL and return false at the start. Probably we should add that back.",
  "published": "2025-11-12T11:15:44Z",
  "severity": "",
  "epss": 0.00241,
  "epssPercentile": 0.15349,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.6-1",
      "fix": "DEBIAN-CVE-2025-40148",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40148",
      "released": "2025-11-12T11:15:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}