CVE-2025-22093 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2025-22093?

CVE-2025-22093 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's AMD display driver allows local attackers to cause a kernel panic (denial of service) when using AMD graphics hardware that doesn't support DMUB (Display Microcontroller Unit B). This affects Linux systems with AMD graphics drivers.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's AMD display driver allows local attackers to cause a kernel panic (denial of service) when using AMD graphics hardware that doesn't support DMUB (Display Microcontroller Unit B). This affects Linux systems with AMD graphics drivers.

💻 Affected Systems

Products:

Linux kernel with AMD display driver (drm/amd/display)

Versions: Linux kernel versions with AMD display driver support for PSR1, specifically vulnerable versions before the fix commits

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with AMD graphics hardware that doesn't support DMUB. The vulnerability triggers during display operations like cursor updates.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel panic, causing system crash and denial of service. In rare cases, could potentially lead to arbitrary code execution in kernel context.

🟠

Likely Case

Local denial of service through kernel panic when specific display operations are performed on affected AMD hardware.

🟢

If Mitigated

No impact if patched or if system doesn't use affected AMD graphics hardware.

🌐 Internet-Facing: LOW - Requires local access to trigger

🏢 Internal Only: MEDIUM - Local users can cause system crashes affecting availability

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple local trigger via display operations

Exploitation requires local access and ability to perform display operations. The crash dump shows it was triggered by DrmThread during cursor operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 3453bcaf2ca9, 35ad39afd007, 42d9d7bed270, 5e4b1e04740c, b3a93a2407ad

Vendor Advisory: https://git.kernel.org/stable/c/3453bcaf2ca92659346bf8504c2b52b3993fbd79

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for security updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable affected AMD graphics hardware

linux

Blacklist or disable the AMD display driver if not needed

echo 'blacklist amdgpu' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable AMD hardware
Monitor for kernel panic events and investigate any crashes related to display operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if using AMD graphics: 'uname -r' and 'lspci | grep -i amd'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond vulnerable commits: 'uname -r' and check kernel changelog for fix commits

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages with 'NULL pointer dereference' in dmub_hw_lock_mgr_cmd
System crashes during display/cursor operations
dmesg showing AMD display driver crashes

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "dmub_hw_lock_mgr_cmd" OR "BUG: kernel")

📊 Metadata

CVE ID: CVE-2025-22093

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.08% exploit probability (23.8th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-22093, you might also want to check these: