CVE-2025-21996: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Is your site exposed to CVE-2025-21996?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-908 CWE-908

Affected Products

Vendor	Product	Versions
linux	linux_kernel	3.15 — 5.4.292
linux	linux_kernel	5.5 — 5.10.236
linux	linux_kernel	5.11 — 5.15.180
linux	linux_kernel	5.16 — 6.1.132
linux	linux_kernel	6.2 — 6.6.85
linux	linux_kernel	6.7 — 6.12.21
linux	linux_kernel	6.13 — 6.13.9
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8

Other References

https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Frequently Asked Questions

What is CVE-2025-21996? +

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68) It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-21996? +

CVE-2025-21996 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-21996? +

CVE-2025-21996 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-21996? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-2329

In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buffer and …

CVE-2025-48513

Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel …

CVE-2026-49425

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero …

CVE-2026-49424

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the …

CVE-2026-58084

To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For …

CVE-2026-49423

When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf …

CVE-2025-21996