PT-2025-28882 · Linux+4 · Linux Kernel+4

Published 2025-07-09 · Updated 2025-11-04 · CVE-2025-38254

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A flaw exists in the Linux kernel’s DRM/AMD/display component where the drm edid raw() function does not guarantee a proper Extended Display Identification Data (EDID) return. This can result in an Oops (kernel panic) if NULL is returned, or memory corruption if the returned EDID data exceeds the allocated buffer size. The issue was reported when connected with a faulty adapter. Sanity checks have been added to drm edid raw() to address these cases, returning EDID BAD INPUT accordingly.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2025-13469

CVE-2025-38254

USN-7833-1

USN-7833-2

USN-7833-3

USN-7833-4

USN-7834-1

USN-7856-1

Affected Products

Amd

Astra Linux

Linuxmint

Linux Kernel

Ubuntu

References · 205

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38254.json · Exploit
• https://ubuntu.com/security/CVE-2025-38237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38225 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38257 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38197 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38353 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38360 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38377 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36357 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38086 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38264 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7833-4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38326 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38189 · Vendor Advisory