CVE-2025-40360drm/sysfb: Do not dereference NULL pointer in plane reset
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Do not dereference NULL pointer in plane reset The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL. v2: - fix typo in commit description (Javier)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- May 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b715650220311e50448cb499c71084ca8aeeeece before 6abeff03cb79a2c7f4554a8e8738acd35bb37152; from b715650220311e50448cb499c71084ca8aeeeece before c4faf7f417eea8b8d5cc570a1015736f307aa2d5; from b715650220311e50448cb499c71084ca8aeeeece before b61ed8005bd3102510fab5015ac6a275c9c5ea16; from b715650220311e50448cb499c71084ca8aeeeece before 6bdef5648a60e49d4a3b02461ab7ae3776877e77; from b715650220311e50448cb499c71084ca8aeeeece before c7d5e69866bbe95c1e4ab4c10a81e0a02d9ea232; from b715650220311e50448cb499c71084ca8aeeeece before 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 | CNA record |
References
- https://git.kernel.org/stable/c/6abeff03cb79a2c7f4554a8e8738acd35bb37152
- https://git.kernel.org/stable/c/c4faf7f417eea8b8d5cc570a1015736f307aa2d5
- https://git.kernel.org/stable/c/b61ed8005bd3102510fab5015ac6a275c9c5ea16
- https://git.kernel.org/stable/c/6bdef5648a60e49d4a3b02461ab7ae3776877e77
- https://git.kernel.org/stable/c/c7d5e69866bbe95c1e4ab4c10a81e0a02d9ea232
- https://git.kernel.org/stable/c/14e02ed3876f4ab0ed6d3f41972175f8b8df3d70
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.