CVE-2025-40354 addresses a flaw in the Linux kernel's AMD display driver where the dc->links array size was insufficient to handle the actual number of requested links, leading to potential out-of-bounds conditions. Additionally, the hardware initialization function (hw_init) could access a NULL LINK_ENC pointer for dpia non-display endpoints, causing a NULL pointer dereference. The fix involved increasing the maximum link count from 12 to 14 and correcting the pointer access to prevent null dereference.

The vulnerability has a high severity rating with a CVSS 3.1 vector indicating local attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Exploitation could lead to system compromise or denial of service due to NULL pointer dereference in kernel space.

A fix has been applied in the Linux kernel source code as indicated by the referenced commit. Users should update to the patched kernel version containing this fix. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory or distribution security updates for the official patch availability and apply it accordingly.