CVE-2025-21976

CVE-2025-21976

High · published April 1, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fbdev: hyperv_fb: Allow graceful removal of framebuffer

When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to

release the framebuffer forcefully. If this framebuffer is in use it

produce the following WARN and hence this framebuffer is never released.

[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40

< snip >

[ 44.111289] Call Trace:

[ 44.111290] <TASK>

[ 44.111291] ? show_regs+0x6c/0x80

[ 44.111295] ? __warn+0x8d/0x150

[ 44.111298] ? framebuffer_release+0x2c/0x40

[ 44.111300] ? report_bug+0x182/0x1b0

[ 44.111303] ? handle_bug+0x6e/0xb0

[ 44.111306] ? exc_invalid_op+0x18/0x80

[ 44.111308] ? asm_exc_invalid_op+0x1b/0x20

[ 44.111311] ? framebuffer_release+0x2c/0x40

[ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb]

[ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus]

[ 44.111323] device_remove+0x40/0x80

[ 44.111325] device_release_driver_internal+0x20b/0x270

[ 44.111327] ? bus_find_device+0xb3/0xf0

Fix this by moving the release of framebuffer and assosiated memory

to fb_ops.fb_destroy function, so that framebuffer framework handles

it gracefully.

While we fix this, also replace manual registrations/unregistration of

framebuffer with devm_register_framebuffer.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Published
2025-04-01T20:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 3.10, < 6.12.206.12.20
linux/linux_kernel≥ 6.13, < 6.13.86.13.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 01 APR 15:47Z
    fbdev: hyperv_fb: Allow graceful removal of framebuffer
    cvelistv5