CVE-2025-21996

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Medium · published April 3, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

On the off chance that command stream passed from userspace via

ioctl() call to radeon_vce_cs_parse() is weirdly crafted and

first command to execute is to encode (case 0x03000001), the function

in question will attempt to call radeon_vce_cs_reloc() with size

argument that has not been properly initialized. Specifically, 'size'

will point to 'tmp' variable before the latter had a chance to be

assigned any value.

Play it safe and init 'tmp' with 0, thus ensuring that

radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static

analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Published
2025-04-03T07:18Z
EPSS history
Timeline
  • 03 APR 07:18Z
    drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
    cvelistv5