VulnerabilityPublished 19 Aug 2025Updated 21 Oct 2026

CVE-2025-38597: Linux kernel · drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f9f68bf1d0efeadb6c427c9dbb30f307a7def19b : update Linux kernel when convenient.

Data as of 26 Oct 2026, 20:48 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f9f68bf1d0efeadb6c427c9dbb30f307a7def19b, e1eef239399927b368f70a716044fb10085627c8, 38682edbbad272b5f8c7bf55128b42cd10626f73 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 604be85547ce4d61b89292d2f9a78c721b778c16, < f9f68bf1d0efeadb6c427c9dbb30f307a7def19b	Fixed in f9f68bf1d0efeadb6c427c9dbb30f307a7def19b
LinuxLinux	Affected ≥ 604be85547ce4d61b89292d2f9a78c721b778c16, < e1eef239399927b368f70a716044fb10085627c8	Fixed in e1eef239399927b368f70a716044fb10085627c8
LinuxLinux	Affected ≥ 604be85547ce4d61b89292d2f9a78c721b778c16, < 38682edbbad272b5f8c7bf55128b42cd10626f73	Fixed in 38682edbbad272b5f8c7bf55128b42cd10626f73
LinuxLinux	Affected ≥ 604be85547ce4d61b89292d2f9a78c721b778c16, < 45be183b9944f765b77623daffb024cb38d192bf	Fixed in 45be183b9944f765b77623daffb024cb38d192bf
LinuxLinux	Affected ≥ 604be85547ce4d61b89292d2f9a78c721b778c16, < 8fc974776c668fef1fc73fefbf573a076bb073e8	Fixed in 8fc974776c668fef1fc73fefbf573a076bb073e8
LinuxLinux	Affected =5.19	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the fix identified by the commits (e.g., those referenced by the fixedVersions hashes). No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's drm/rockchip vop2 driver can cause a null-pointer dereference when a primary plane for a video-port is missing. This occurs because the code assumes a primary plane exists without verifying it, leading to a failure during probing. The issue was identified with the rk3576 vp2 hardware configuration. The vulnerability has been fixed by adding a check to fail cleanly if no primary plane is found during initialization.

Impact

If triggered, this vulnerability causes a null-pointer dereference in the kernel, which can lead to a kernel crash (panic) or denial of service. There is no indication of privilege escalation or code execution. The impact is limited to system stability and availability.

Summary

The Linux kernel drm/rockchip vop2 driver expects each video-port to have a designated primary plane. During binding, the driver searches for a primary plane usable by the video-port but does not verify if such a plane was found before calling drm_crtc_init_with_planes. On rk3576 vp2 hardware, the absence of a usable primary plane for vp2 (when vp0 is in use) leads to a null-pointer dereference. The fix adds a check after iterating windows to ensure a primary plane was found and fails probing if not, preventing the kernel from dereferencing a null pointer.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 20:48 UTC

Technical details

References

Community reviews

Related threats