CVE-2025-21697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21697", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.748Z", "datePublished": "2025-02-12T13:27:55.488Z", "dateUpdated": "2026-08-05T11:53:40.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:40.900Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the v3d DRM ioctls (`V3D_SUBMIT_CL`/`SUBMIT_CSD`/`SUBMIT_TFU`) on the render node `/dev/dri/renderD128`, which requires local access to the device file. There is no network-facing path into the GPU job submission code.\nAC:L - The attacker controls both sides of the race \u2014 the size/duration of the binner control list that raises the OUTOMEM interrupt and the submission cadence that determines when the bin job completes relative to `v3d_overflow_mem_work()` \u2014 and the driver comment notes the hardware signals OOM before it is fully OOM, making the window occur naturally. Submission can be repeated indefinitely at no cost until the race is won.\nPR:L - An unprivileged local user only needs an open file descriptor on the DRM render node, which is granted to ordinary desktop/graphics users (render/video group) on Raspberry Pi OS and to GPU-passthrough containers; no CAP_SYS_ADMIN or root is required. All relevant ioctls are marked DRM_RENDER_ALLOW, and the upstream crash report shows the path being hit by UID 1000.\nUI:N - The attacker triggers everything itself by submitting GPU jobs from its own process; no victim action, file open, or administrator step is needed.\nS:U - The stale pointer, the freed job object, and the corrupted memory all live in the kernel's own security authority, and the impact is confined to kernel privilege escalation on the same host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `v3d->bin_job` is dereferenced after `kfree()`, so `v3d_overflow_mem_work()` and `v3d_irq()` read `->render`, `->base.irq_fence`, and stats fields out of a reclaimed slab object whose contents the attacker can groom, yielding an arbitrary-read primitive and kernel pointer disclosure.\nI:H - `list_add_tail(&bo->unref_head, &v3d->bin_job->render->unref_list)` writes kernel pointers through a `->render` value read from freed, attacker-sprayable memory, giving a controlled write primitive; `v3d_job_update_stats()` likewise writes into the freed object. This is a classic use-after-free that can be leveraged into arbitrary write and control-flow hijack.\nA:H - Dereferencing the freed job object reliably oopses or panics the kernel \u2014 the related regression on this same pointer produced \"Kernel panic - not syncing: Oops: Fatal exception in interrupt\" in `v3d_irq()`. Any local user with render-node access can crash the machine on demand."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "versions": [{"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "1bd6303d08c85072ce40ac01a767ab67195105bd", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "a34050f70e7955a359874dff1a912a748724a140", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "14e0a874488e79086340ba8e2d238cb9596b68a8", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "2a1c88f7ca5c12dff6fa6787492ac910bb9e4407", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "b22467b1ae104073dcb11aa78562a331cd7fb0e0", "status": "affected", "versionType": "git"}, {"version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "e4b5ccd392b92300a2b341705cc4805681094e49", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.290", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.234", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.177", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.127", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.74", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.11", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.290"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.234"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.127"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.74"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd"}, {"url": "https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140"}, {"url": "https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8"}, {"url": "https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407"}, {"url": "https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3"}, {"url": "https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0"}, {"url": "https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49"}], "title": "drm/v3d: Ensure job pointer is set to NULL after job completion", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:51:11.490682Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:57:09.517Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:20.493Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:20.493Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:51:11.490682Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T16:00:33.706Z"}}], "cna": {"title": "drm/v3d: Ensure job pointer is set to NULL after job completion", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the v3d DRM ioctls (`V3D_SUBMIT_CL`/`SUBMIT_CSD`/`SUBMIT_TFU`) on the render node `/dev/dri/renderD128`, which requires local access to the device file. There is no network-facing path into the GPU job submission code.\nAC:L - The attacker controls both sides of the race \u2014 the size/duration of the binner control list that raises the OUTOMEM interrupt and the submission cadence that determines when the bin job completes relative to `v3d_overflow_mem_work()` \u2014 and the driver comment notes the hardware signals OOM before it is fully OOM, making the window occur naturally. Submission can be repeated indefinitely at no cost until the race is won.\nPR:L - An unprivileged local user only needs an open file descriptor on the DRM render node, which is granted to ordinary desktop/graphics users (render/video group) on Raspberry Pi OS and to GPU-passthrough containers; no CAP_SYS_ADMIN or root is required. All relevant ioctls are marked DRM_RENDER_ALLOW, and the upstream crash report shows the path being hit by UID 1000.\nUI:N - The attacker triggers everything itself by submitting GPU jobs from its own process; no victim action, file open, or administrator step is needed.\nS:U - The stale pointer, the freed job object, and the corrupted memory all live in the kernel's own security authority, and the impact is confined to kernel privilege escalation on the same host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `v3d->bin_job` is dereferenced after `kfree()`, so `v3d_overflow_mem_work()` and `v3d_irq()` read `->render`, `->base.irq_fence`, and stats fields out of a reclaimed slab object whose contents the attacker can groom, yielding an arbitrary-read primitive and kernel pointer disclosure.\nI:H - `list_add_tail(&bo->unref_head, &v3d->bin_job->render->unref_list)` writes kernel pointers through a `->render` value read from freed, attacker-sprayable memory, giving a controlled write primitive; `v3d_job_update_stats()` likewise writes into the freed object. This is a classic use-after-free that can be leveraged into arbitrary write and control-flow hijack.\nA:H - Dereferencing the freed job object reliably oopses or panics the kernel \u2014 the related regression on this same pointer produced \"Kernel panic - not syncing: Oops: Fatal exception in interrupt\" in `v3d_irq()`. Any local user with render-node access can crash the machine on demand."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "1bd6303d08c85072ce40ac01a767ab67195105bd", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "a34050f70e7955a359874dff1a912a748724a140", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "14e0a874488e79086340ba8e2d238cb9596b68a8", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "2a1c88f7ca5c12dff6fa6787492ac910bb9e4407", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "b22467b1ae104073dcb11aa78562a331cd7fb0e0", "versionType": "git"}, {"status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "lessThan": "e4b5ccd392b92300a2b341705cc4805681094e49", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.290", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.234", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.177", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.127", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.74", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.11", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd"}, {"url": "https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140"}, {"url": "https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8"}, {"url": "https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407"}, {"url": "https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3"}, {"url": "https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0"}, {"url": "https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.290", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.234", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.177", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.127", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.74", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.11", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:40.900Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21697", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:53:40.900Z", "dateReserved": "2024-12-29T08:45:45.748Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-12T13:27:55.488Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1bd6303d08c85072ce40ac01a767ab67195105bd", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "a34050f70e7955a359874dff1a912a748724a140", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "14e0a874488e79086340ba8e2d238cb9596b68a8", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "2a1c88f7ca5c12dff6fa6787492ac910bb9e4407", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "b22467b1ae104073dcb11aa78562a331cd7fb0e0", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}, {"lessThan": "e4b5ccd392b92300a2b341705cc4805681094e49", "status": "affected", "version": "14d1d190869685d3a1e8a3f63924e20594557cb2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/v3d/v3d_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.290", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.234", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.177", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.127", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.74", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "64B1A02A-1434-4997-81B9-40B92C7643B3", "versionEndExcluding": "5.4.290", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F732162B-ED7E-4367-A5C2-B24FD9B0D33B", "versionEndExcluding": "5.10.234", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71A3AFDC-A3CA-454F-8917-E998BBDE36F8", "versionEndExcluding": "5.15.177", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3538C88-E91E-4A62-8415-2EA2F03EAAE3", "versionEndExcluding": "6.1.127", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38B2F4A9-C656-4A97-8718-D27E6BDFD82A", "versionEndExcluding": "6.6.74", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7D0DBC3-F63C-4396-8A47-6F3D4FA0556E", "versionEndExcluding": "6.12.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*", "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*", "matchCriteriaId": "8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*", "matchCriteriaId": "5DFCDFB8-4FD0-465A-9076-D813D78FE51B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Aseg\u00farese de que el puntero de trabajo est\u00e9 configurado en NULL despu\u00e9s de la finalizaci\u00f3n del trabajo. Despu\u00e9s de que se complete un trabajo, el puntero correspondiente en el dispositivo debe configurarse en NULL. Si no se hace esto, se activa una advertencia al descargar el controlador, ya que parece que el trabajo a\u00fan est\u00e1 activo. Para evitar esto, asigne el puntero de trabajo a NULL despu\u00e9s de completar el trabajo, lo que indica que el trabajo ha finalizado."}], "id": "CVE-2025-21697", "lastModified": "2026-07-30T06:19:18.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21697", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:51:11.490682Z", "version": "2.0.3"}}]}, "published": "2025-02-12T14:15:32.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a34050f70e7955a359874dff1a912a748724a140"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b22467b1ae104073dcb11aa78562a331cd7fb0e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e4b5ccd392b92300a2b341705cc4805681094e49"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/v3d: Ensure job pointer is set to NULL after job completion", "id": "2345195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345195"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/v3d: Ensure job pointer is set to NULL after job completion\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished."], "name": "CVE-2025-21697", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21697\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21697\nhttps://lore.kernel.org/linux-cve-announce/2025021259-CVE-2025-21697-e883@gregkh/T"], "threat_severity": "Moderate"}

{}