CVE-2025-40011

Vulnerability

In the Linux kernel's gma500 DRM driver, a null pointer dereference vulnerability exists in the HDMI teardown path. The root cause is an ordering mistake: pci_set_drvdata() sets pdev->driver_data to NULL, but the code subsequently extracts i2c_dev from the same driver data in oaktrail_hdmi_i2c_exit(), leading to a null pointer dereference. [1]

Exploitation

The vulnerability is triggered during device removal or module unloading, when the HDMI subsystem is torn down. An attacker would need local access to the system and the ability to trigger the underlying device removal (e.g., via hot-unplug or driver unbind). No authentication is required beyond the ability to interact with the driver interfaces. [1]

Impact

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (denial of service). The vulnerability does not appear to allow privilege escalation or arbitrary code execution based on the description. [1]

Mitigation

The fix, which is to swap the pci_set_drvdata() call and the oaktrail_hdmi_i2c_exit() call, has been applied to the Linux kernel stable branches. Patched versions are available via the referenced commits. [1] Users should update their kernel to incorporate the fix.