CVE-2025-21976

Source
https://cve.org/CVERecord?id=CVE-2025-21976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-21976
Downstream
AZL (2)
BELL (1)
DEBIAN (1)
ECHO (1)
MINI (1)
OESA (2)
RHSA (1)
RLSA (1)
ROOT (4)
SUSE (1)
UBUNTU (1)
Related
Published
2025-04-01T15:47:07Z
Modified
2026-10-22T02:49:04Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
fbdev: hyperv_fb: Allow graceful removal of framebuffer
Details

In the Linux kernel, the following vulnerability has been resolved:

fbdev: hyperv_fb: Allow graceful removal of framebuffer

When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released.

[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [ 44.111290] [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ? framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [ 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ? framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325] device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0

Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework handles it gracefully.

While we fix this, also replace manual registrations/unregistration of framebuffer with devm_register_framebuffer.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21976.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68a2d20b79b105f02dcbc52c211d7e62f98996b7
Fixed
b1a86a5ab0d44160534f495a3630646092d98e27
Fixed
4545e2aa121aea304d33903099c03e29ed4fe50a
Fixed
a7b583dc99c6cf4a96877017be1d08247e1ef2c7
Fixed
ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21976.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.10.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.20
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.8

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21976.json"