CVE-2025-21996

Published Apr 3, 2025

Last updated 2 months ago

CVSS medium 5.5

Overview

Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-908

Hype score: Not currently trending

CVE-2025-21996 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command… https://t.co/822LOtaAai
@CVEnew
3 Apr 2025
97 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D4660074-26FA-4E74-8832-E233777FB233",
            "versionEndExcluding": "5.4.292",
            "versionStartIncluding": "3.15"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1DF46FB0-9163-4ABE-8CCA-32A497D4715B",
            "versionEndExcluding": "5.10.236",
            "versionStartIncluding": "5.5"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D19801C8-3D18-405D-9989-E6C9B30255FA",
            "versionEndExcluding": "5.15.180",
            "versionStartIncluding": "5.11"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "91D1C2F6-55A1-4CF4-AC66-ADF758259C59",
            "versionEndExcluding": "6.1.132",
            "versionStartIncluding": "5.16"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCB56F36-C998-496A-A2E4-D9E0BB3A5BFC",
            "versionEndExcluding": "6.6.85",
            "versionStartIncluding": "6.2"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3B63C450-D73B-4A53-9861-98E25C16E842",
            "versionEndExcluding": "6.12.21",
            "versionStartIncluding": "6.7"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FAECBE4D-58CF-4836-BBAB-5E28B800A778",
            "versionEndExcluding": "6.13.9",
            "versionStartIncluding": "6.13"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References