CVE-2025-21697 (GCVE-0-2025-21697)

Vulnerability from cvelistv5 – Published: 2025-02-12 13:27 – Updated: 2026-08-05 11:53
VLAI
Title
drm/v3d: Ensure job pointer is set to NULL after job completion
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Ensure job pointer is set to NULL after job completion After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when unloading the driver, as it appears the job is still active. To prevent this, assign the job pointer to NULL after completing the job, indicating the job has finished.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < 1bd6303d08c85072ce40ac01a767ab67195105bd (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < a34050f70e7955a359874dff1a912a748724a140 (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < 14e0a874488e79086340ba8e2d238cb9596b68a8 (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < 2a1c88f7ca5c12dff6fa6787492ac910bb9e4407 (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < 63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3 (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < b22467b1ae104073dcb11aa78562a331cd7fb0e0 (git)
Affected: 14d1d190869685d3a1e8a3f63924e20594557cb2 , < e4b5ccd392b92300a2b341705cc4805681094e49 (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.4.290 , ≤ 5.4.* (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.177 , ≤ 5.15.* (semver)
Unaffected: 6.1.127 , ≤ 6.1.* (semver)
Unaffected: 6.6.74 , ≤ 6.6.* (semver)
Unaffected: 6.12.11 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:51:11.490682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:09.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:59:20.493Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1bd6303d08c85072ce40ac01a767ab67195105bd",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "a34050f70e7955a359874dff1a912a748724a140",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "14e0a874488e79086340ba8e2d238cb9596b68a8",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "2a1c88f7ca5c12dff6fa6787492ac910bb9e4407",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b22467b1ae104073dcb11aa78562a331cd7fb0e0",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            },
            {
              "lessThan": "e4b5ccd392b92300a2b341705cc4805681094e49",
              "status": "affected",
              "version": "14d1d190869685d3a1e8a3f63924e20594557cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.290",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.127",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.74",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.11",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the v3d DRM ioctls (`V3D_SUBMIT_CL`/`SUBMIT_CSD`/`SUBMIT_TFU`) on the render node `/dev/dri/renderD128`, which requires local access to the device file. There is no network-facing path into the GPU job submission code.\nAC:L - The attacker controls both sides of the race \u2014 the size/duration of the binner control list that raises the OUTOMEM interrupt and the submission cadence that determines when the bin job completes relative to `v3d_overflow_mem_work()` \u2014 and the driver comment notes the hardware signals OOM before it is fully OOM, making the window occur naturally. Submission can be repeated indefinitely at no cost until the race is won.\nPR:L - An unprivileged local user only needs an open file descriptor on the DRM render node, which is granted to ordinary desktop/graphics users (render/video group) on Raspberry Pi OS and to GPU-passthrough containers; no CAP_SYS_ADMIN or root is required. All relevant ioctls are marked DRM_RENDER_ALLOW, and the upstream crash report shows the path being hit by UID 1000.\nUI:N - The attacker triggers everything itself by submitting GPU jobs from its own process; no victim action, file open, or administrator step is needed.\nS:U - The stale pointer, the freed job object, and the corrupted memory all live in the kernel\u0027s own security authority, and the impact is confined to kernel privilege escalation on the same host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `v3d-\u003ebin_job` is dereferenced after `kfree()`, so `v3d_overflow_mem_work()` and `v3d_irq()` read `-\u003erender`, `-\u003ebase.irq_fence`, and stats fields out of a reclaimed slab object whose contents the attacker can groom, yielding an arbitrary-read primitive and kernel pointer disclosure.\nI:H - `list_add_tail(\u0026bo-\u003eunref_head, \u0026v3d-\u003ebin_job-\u003erender-\u003eunref_list)` writes kernel pointers through a `-\u003erender` value read from freed, attacker-sprayable memory, giving a controlled write primitive; `v3d_job_update_stats()` likewise writes into the freed object. This is a classic use-after-free that can be leveraged into arbitrary write and control-flow hijack.\nA:H - Dereferencing the freed job object reliably oopses or panics the kernel \u2014 the related regression on this same pointer produced \"Kernel panic - not syncing: Oops: Fatal exception in interrupt\" in `v3d_irq()`. Any local user with render-node access can crash the machine on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:40.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140"
        },
        {
          "url": "https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407"
        },
        {
          "url": "https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49"
        }
      ],
      "title": "drm/v3d: Ensure job pointer is set to NULL after job completion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21697",
    "datePublished": "2025-02-12T13:27:55.488Z",
    "dateReserved": "2024-12-29T08:45:45.748Z",
    "dateUpdated": "2026-08-05T11:53:40.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21697",
      "date": "2026-08-05",
      "epss": "0.0023",
      "percentile": "0.1392"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:21:15.000Z",
      "cve": "CVE-2025-21697",
      "id": "msrc_CVE-2025-21697",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/v3d: Ensure job pointer is set to NULL after job completion",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21697.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21697\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-12T14:15:32.787\",\"lastModified\":\"2026-07-30T06:19:18.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Ensure job pointer is set to NULL after job completion\\n\\nAfter a job completes, the corresponding pointer in the device must\\nbe set to NULL. Failing to do so triggers a warning when unloading\\nthe driver, as it appears the job is still active. To prevent this,\\nassign the job pointer to NULL after completing the job, indicating\\nthe job has finished.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Aseg\u00farese de que el puntero de trabajo est\u00e9 configurado en NULL despu\u00e9s de la finalizaci\u00f3n del trabajo. Despu\u00e9s de que se complete un trabajo, el puntero correspondiente en el dispositivo debe configurarse en NULL. Si no se hace esto, se activa una advertencia al descargar el controlador, ya que parece que el trabajo a\u00fan est\u00e1 activo. Para evitar esto, asigne el puntero de trabajo a NULL despu\u00e9s de completar el trabajo, lo que indica que el trabajo ha finalizado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"1bd6303d08c85072ce40ac01a767ab67195105bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"a34050f70e7955a359874dff1a912a748724a140\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"14e0a874488e79086340ba8e2d238cb9596b68a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"2a1c88f7ca5c12dff6fa6787492ac910bb9e4407\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"b22467b1ae104073dcb11aa78562a331cd7fb0e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"14d1d190869685d3a1e8a3f63924e20594557cb2\",\"lessThan\":\"e4b5ccd392b92300a2b341705cc4805681094e49\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.290\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.177\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.127\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.74\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.11\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:51:11.490682Z\",\"id\":\"CVE-2025-21697\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"5.4.290\",\"matchCriteriaId\":\"64B1A02A-1434-4997-81B9-40B92C7643B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.234\",\"matchCriteriaId\":\"F732162B-ED7E-4367-A5C2-B24FD9B0D33B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.177\",\"matchCriteriaId\":\"71A3AFDC-A3CA-454F-8917-E998BBDE36F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.127\",\"matchCriteriaId\":\"A3538C88-E91E-4A62-8415-2EA2F03EAAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.74\",\"matchCriteriaId\":\"38B2F4A9-C656-4A97-8718-D27E6BDFD82A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.11\",\"matchCriteriaId\":\"B7D0DBC3-F63C-4396-8A47-6F3D4FA0556E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:41:38+00:00",
      "cve": "CVE-2025-21697",
      "id": "CVE-2025-21697",
      "initial_release_date": "2025-02-12T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/v3d: Ensure job pointer is set to NULL after job completion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21697.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-15T19:06:07Z",
      "cve": "CVE-2025-21697",
      "id": "CVE-2025-21697",
      "initial_release_date": "2025-02-13T00:20:38Z",
      "product_status:known_affected": "610",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "336",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21697",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21697.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:59:20.493Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21697\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:51:11.490682Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:00:33.706Z\"}}], \"cna\": {\"title\": \"drm/v3d: Ensure job pointer is set to NULL after job completion\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through the v3d DRM ioctls (`V3D_SUBMIT_CL`/`SUBMIT_CSD`/`SUBMIT_TFU`) on the render node `/dev/dri/renderD128`, which requires local access to the device file. There is no network-facing path into the GPU job submission code.\\nAC:L - The attacker controls both sides of the race \\u2014 the size/duration of the binner control list that raises the OUTOMEM interrupt and the submission cadence that determines when the bin job completes relative to `v3d_overflow_mem_work()` \\u2014 and the driver comment notes the hardware signals OOM before it is fully OOM, making the window occur naturally. Submission can be repeated indefinitely at no cost until the race is won.\\nPR:L - An unprivileged local user only needs an open file descriptor on the DRM render node, which is granted to ordinary desktop/graphics users (render/video group) on Raspberry Pi OS and to GPU-passthrough containers; no CAP_SYS_ADMIN or root is required. All relevant ioctls are marked DRM_RENDER_ALLOW, and the upstream crash report shows the path being hit by UID 1000.\\nUI:N - The attacker triggers everything itself by submitting GPU jobs from its own process; no victim action, file open, or administrator step is needed.\\nS:U - The stale pointer, the freed job object, and the corrupted memory all live in the kernel\u0027s own security authority, and the impact is confined to kernel privilege escalation on the same host. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The dangling `v3d-\u003ebin_job` is dereferenced after `kfree()`, so `v3d_overflow_mem_work()` and `v3d_irq()` read `-\u003erender`, `-\u003ebase.irq_fence`, and stats fields out of a reclaimed slab object whose contents the attacker can groom, yielding an arbitrary-read primitive and kernel pointer disclosure.\\nI:H - `list_add_tail(\u0026bo-\u003eunref_head, \u0026v3d-\u003ebin_job-\u003erender-\u003eunref_list)` writes kernel pointers through a `-\u003erender` value read from freed, attacker-sprayable memory, giving a controlled write primitive; `v3d_job_update_stats()` likewise writes into the freed object. This is a classic use-after-free that can be leveraged into arbitrary write and control-flow hijack.\\nA:H - Dereferencing the freed job object reliably oopses or panics the kernel \\u2014 the related regression on this same pointer produced \\\"Kernel panic - not syncing: Oops: Fatal exception in interrupt\\\" in `v3d_irq()`. Any local user with render-node access can crash the machine on demand.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"1bd6303d08c85072ce40ac01a767ab67195105bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"a34050f70e7955a359874dff1a912a748724a140\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"14e0a874488e79086340ba8e2d238cb9596b68a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"2a1c88f7ca5c12dff6fa6787492ac910bb9e4407\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"b22467b1ae104073dcb11aa78562a331cd7fb0e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"14d1d190869685d3a1e8a3f63924e20594557cb2\", \"lessThan\": \"e4b5ccd392b92300a2b341705cc4805681094e49\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_irq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.290\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.177\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.127\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.74\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/v3d/v3d_irq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd\"}, {\"url\": \"https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140\"}, {\"url\": \"https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8\"}, {\"url\": \"https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407\"}, {\"url\": \"https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3\"}, {\"url\": \"https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0\"}, {\"url\": \"https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Ensure job pointer is set to NULL after job completion\\n\\nAfter a job completes, the corresponding pointer in the device must\\nbe set to NULL. Failing to do so triggers a warning when unloading\\nthe driver, as it appears the job is still active. To prevent this,\\nassign the job pointer to NULL after completing the job, indicating\\nthe job has finished.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.290\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.177\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.127\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.74\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.11\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:40.900Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21697\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:40.900Z\", \"dateReserved\": \"2024-12-29T08:45:45.748Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-12T13:27:55.488Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.