CVE-2025-38319: debian debian_linux NULL Pointer Dereference
Vulnerability summary
CVE-2025-38319 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 53 · Related 49Timeline
- 10-07-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, it returns NULL which is later dereferenced.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
+0.02 pp
From 0.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu141 products
- linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.147-1 | < 6.12.35-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ b3892e2bb519fe18225d0628f0dd255761f16502, < 85cdcb834fb490731ff2d123f87ca799c57dacf2 | ≥ b3892e2bb519fe18225d0628f0dd255761f16502, < 7080c20a9139842033ed4af604dc1fa4028593ad | ≥ b3892e2bb519fe18225d0628f0dd255761f16502, < cdf7e1ff99ab06ef15d0b5d1aca5258a4fb62b85 | ≥ b3892e2bb519fe18225d0628f0dd255761f16502, < 64f3acc8c7e6809631457b75638601b36dea3129 | ≥ b3892e2bb519fe18225d0628f0dd255761f16502, < a4ff7391c8b75b1541900bd9d0c238e558c11fb3 | ≥ b3892e2bb519fe18225d0628f0dd255761f16502, < 820116a39f96bdc7d426c33a804b52f53700a919 | 4.18
- linux_kernel≥ 4.18, < 5.15.186 | ≥ 5.16, < 6.1.142 | ≥ 6.2, < 6.6.94 | ≥ 6.7, < 6.12.34 | ≥ 6.13, < 6.15.3
3 vendors · 145 products
References
44 links- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlThird Party Advisory