CVE-2025-21996drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
- 5.5MediumCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 13 months later
· 13 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < 0effb378ebce52b897f85cd7f828854b8c7cb636
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < 5b4d9d20fd455a97920cf158dd19163b879cf65d
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < 9b2da9c673a0da1359a2151f7ce773e2f77d71a9
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < 78b07dada3f02f77762d0755a96d35f53b02be69
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < 3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < dd1801aa01bba1760357f2a641346ae149686713
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < f5e049028124f755283f2c07e7a3708361ed1dc8
- affected 2fc5703abda201f138faf63bdca743d04dbf4b1a – < dd8689b52a24807c2d5ce0a17cb26dc87f75235c
- affected 3.15
- unaffected < 3.15
- unaffected 5.4.292 – ≤ 5.4.*
- unaffected 5.10.236 – ≤ 5.10.*
- unaffected 5.15.180 – ≤ 5.15.*
- unaffected 6.1.132 – ≤ 6.1.*
- unaffected 6.6.85 – ≤ 6.6.*
- unaffected 6.12.21 – ≤ 6.12.*
- unaffected 6.13.9 – ≤ 6.13.*
- unaffected 6.14 – ≤ *
References
References10
- https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 (opens in a new tab)
- https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d (opens in a new tab)
- https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 (opens in a new tab)
- https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 (opens in a new tab)
- https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 (opens in a new tab)
- https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 (opens in a new tab)
- https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8 (opens in a new tab)
- https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-9590 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-21996)Record last updated .