CVE-2025-21688
published 2025-02-10CVE-2025-21688: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9…
PriorityP417medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.18%
8.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Assign job pointer to NULL before signaling the fence
In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL
after job completion"), we introduced a change to assign the job pointer
to NULL after completing a job, indicating job completion.
However, this approach created a race condition between the DRM
scheduler workqueue and the IRQ execution thread. As soon as the fence is
signaled in the IRQ execution thread, a new job starts to be executed.
This results in a race condition where the IRQ execution thread sets the
job pointer to NULL simultaneously as the `run_job()` function assigns
a new job to the pointer.
This race condition can lead to a NULL pointer dereference if the IRQ
execution thread sets the job pointer to NULL after `run_job()` assigns
it to the new job. When the new job completes and the GPU emits an
interrupt, `v3d_irq()` is triggered, potentially causing a crash.
[ 466.310099] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0
[ 466.318928] Mem abort info:
[ 466.321723] ESR = 0x0000000096000005
[ 466.325479] EC = 0x25: DABT (current EL), IL = 32 bits
[ 466.330807] SET = 0, FnV = 0
[ 466.333864] EA = 0, S1PTW = 0
[ 466.337010] FSC = 0x05: level 1 translation fault
[ 466.341900] Data abort info:
[ 466.344783] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 466.350285] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 466.355350] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 466.360677] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000089772000
[ 466.367140] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[ 466.375875] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[ 466.382163] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep binfmt_misc vc4 snd_soc_hdmi_codec drm_display_helper cec brcmfmac_wcc spidev rpivid_hevc(C) drm_clien
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.128-1 (bookworm) | linux 6.1.128-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.128-1 (bookworm) | linux 6.1.128-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 14e0a874488e79086340ba8e2d238cb9596b68a8 < 6cfafcad46e95351c477da0ae7e3acb8f7550ada | 6cfafcad46e95351c477da0ae7e3acb8f7550ada |
| linux | linux | >= 1bd6303d08c85072ce40ac01a767ab67195105bd < 9793206fbf5293534c3a79d78f196e2cbb48c22d | 9793206fbf5293534c3a79d78f196e2cbb48c22d |
| linux | linux | >= 2a1c88f7ca5c12dff6fa6787492ac910bb9e4407 < a9401cd5d1bb5a0b8d2bef09623ca43551cd6e8a | a9401cd5d1bb5a0b8d2bef09623ca43551cd6e8a |
| linux | linux | >= 5.15.177 < 5.15.178 | 5.15.178 |
| linux | linux | >= 6.1.127 < 6.1.128 | 6.1.128 |
| linux | linux | >= 6.12.11 < 6.12.12 | 6.12.12 |
| linux | linux | >= 6.6.74 < 6.6.75 | 6.6.75 |
| linux | linux | >= 63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3 < 431fb709db434565b5e7cee82a11bd681a794fd3 | 431fb709db434565b5e7cee82a11bd681a794fd3 |
| linux | linux | >= a34050f70e7955a359874dff1a912a748724a140 < 1f66a3a1a516e4d545906916b3f3c8d1c5e909e6 | 1f66a3a1a516e4d545906916b3f3c8d1c5e909e6 |
| linux | linux | >= b22467b1ae104073dcb11aa78562a331cd7fb0e0 < 01a7e3a43ee2e6607169a75889412344c10b37fd | 01a7e3a43ee2e6607169a75889412344c10b37fd |
| linux | linux | >= e4b5ccd392b92300a2b341705cc4805681094e49 < 3059e7aaa280daea57bb069fbc65225e1bb95014 | 3059e7aaa280daea57bb069fbc65225e1bb95014 |
| linux | linux | >= e4b5ccd392b92300a2b341705cc4805681094e49 < 6e64d6b3a3c39655de56682ec83e894978d23412 | 6e64d6b3a3c39655de56682ec83e894978d23412 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.234-1 | 5.10.234-1 |
| linux | linux_kernel | >= 0 < 6.1.128-1 | 6.1.128-1 |
| linux | linux_kernel | >= 0 < 6.12.12-1 | 6.12.12-1 |
| linux | linux_kernel | >= 0 < 6.12.12-1 | 6.12.12-1 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-21688: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd39
osv·2025-02-10·CVSS 4.7
CVE-2025-21688 [MEDIUM] CVE-2025-21688: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd39
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL after job completion"), we introduced a change to assign the job pointer to NULL after completing a job, indicating job completion. However, this approach created a race condition between the DRM scheduler workqueue and the IRQ execution thread. As soon as the fence is signaled in the IRQ execution thread, a new job starts to be executed. This results in a race condition where the IRQ execution thread sets the job pointer to NULL simultaneously as the `run_job()` function assigns a new job to the pointer. This race condition can lead to a NULL pointer dereference if the IRQ execution thread set
GHSA
GHSA-gjcc-jpc7-jff7: In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Assign job pointer to NULL before signaling the fence
In commit e4b5ccd
ghsa_unreviewed·2025-02-10
CVE-2025-21688 [MEDIUM] CWE-362 GHSA-gjcc-jpc7-jff7: In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Assign job pointer to NULL before signaling the fence
In commit e4b5ccd
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Assign job pointer to NULL before signaling the fence
In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL
after job completion"), we introduced a change to assign the job pointer
to NULL after completing a job, indicating job completion.
However, this approach created a race condition between the DRM
scheduler workqueue and the IRQ execution thread. As soon as the fence is
signaled in the IRQ execution thread, a new job starts to be executed.
This results in a race condition where the IRQ execution thread sets the
job pointer to NULL simultaneously as the `run_job()` function assigns
a new job to the pointer.
This race condition can lead to a NULL pointer dereference if the IRQ
execution thread
Red Hat
kernel: drm/v3d: Assign job pointer to NULL before signaling the fence
vendor_redhat·2025-02-10·CVSS 4.7
CVE-2025-21688 [MEDIUM] CWE-362 kernel: drm/v3d: Assign job pointer to NULL before signaling the fence
kernel: drm/v3d: Assign job pointer to NULL before signaling the fence
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Assign job pointer to NULL before signaling the fence
In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL
after job completion"), we introduced a change to assign the job pointer
to NULL after completing a job, indicating job completion.
However, this approach created a race condition between the DRM
scheduler workqueue and the IRQ execution thread. As soon as the fence is
signaled in the IRQ execution thread, a new job starts to be executed.
This results in a race condition where the IRQ execution thread sets the
job pointer to NULL simultaneously as the `run_job()` function assigns
a new job to the pointer.
This race conditio
Debian
CVE-2025-21688: linux - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: As...
vendor_debian·2025·CVSS 4.7
CVE-2025-21688 [MEDIUM] CVE-2025-21688: linux - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: As...
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL after job completion"), we introduced a change to assign the job pointer to NULL after completing a job, indicating job completion. However, this approach created a race condition between the DRM scheduler workqueue and the IRQ execution thread. As soon as the fence is signaled in the IRQ execution thread, a new job starts to be executed. This results in a race condition where the IRQ execution thread sets the job pointer to NULL simultaneously as the `run_job()` function assigns a new job to the pointer. This race condition can lead to a NULL pointer dereference if the IRQ execution thread set
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/01a7e3a43ee2e6607169a75889412344c10b37fdhttps://git.kernel.org/stable/c/1f66a3a1a516e4d545906916b3f3c8d1c5e909e6https://git.kernel.org/stable/c/3059e7aaa280daea57bb069fbc65225e1bb95014https://git.kernel.org/stable/c/431fb709db434565b5e7cee82a11bd681a794fd3https://git.kernel.org/stable/c/6cfafcad46e95351c477da0ae7e3acb8f7550adahttps://git.kernel.org/stable/c/6e64d6b3a3c39655de56682ec83e894978d23412https://git.kernel.org/stable/c/9793206fbf5293534c3a79d78f196e2cbb48c22dhttps://git.kernel.org/stable/c/a9401cd5d1bb5a0b8d2bef09623ca43551cd6e8ahttps://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
2025-02-10
Published