CVE-2025-21976 fbdev: hyperv_fb: Allow graceful removal of framebuffer
A flaw in the Hyper-V framebuffer driver prevents graceful device removal, potentially causing resource leaks or warnings when unbinding active framebuffers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21976?
CVE-2025-21976 is a high-severity denial of service vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: hyperv_fb: Allow graceful removal of framebuffer
When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released.
[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [ 44.111290] <TASK> [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ? framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [ 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ? framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325] device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0
Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework handles it gracefully.
While we fix this, also replace manual registrations/unregistration of framebuffer with devm_register_framebuffer.
Which versions are affected by CVE-2025-21976?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21976?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-21976 being exploited?
There is no known exploitation of CVE-2025-21976 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62824, AZL-69506, BELL-CVE-2025-21976, DEBIAN-CVE-2025-21976, GHSA-9vff-p882-x7qp, ROOT-OS-DEBIAN-11-CVE-2025-21976 and 4 more.