# CVE-2025-40148: linux: In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add NULL pointer checks in dc_s...

CVE-2025-40148 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40148 (version 6.17.6-1), released November 12, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-40148
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 12, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions  The function dc_stream_set_cursor_attributes() currently dereferences the `stream` pointer and nested members `stream->ctx->dc->current_state` without checking for NULL.  All callers of these functions, such as in `dcn30_apply_idle_power_optimizations()` and `amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks before calling these functions.  Fixes below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() error: we previously assumed 'stream' could be null (see line 334)  drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c     327 bool dc_stream_program_cursor_attributes(     328         struct dc_stream_state *stream,     329         const struct dc_cursor_attributes *attributes)     330 {     331         struct dc  *dc;     332         bool reset_idle_optimizations = false;     333     334         dc = stream ? stream->ctx->dc : NULL;                      ^^^^^^ The old code assumed stream could be NULL.      335 --> 336         if (dc_stream_set_cursor_attributes(stream, attributes)) {                                                     ^^^^^^ The refactor added an unchecked dereference.  drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c    313  bool dc_stream_set_cursor_attributes(    314          struct dc_stream_state *stream,    315          const struct dc_cursor_attributes *attributes)    316  {    317          bool result = false;    318    319          if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. This function used to check for if stream as NULL and return false at the start. Probably we should add that back.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40148](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40148.md) | Nov 12, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.