CVE-2025-21990 drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
A missing null check in the AMD GPU driver can cause a kernel crash when handling specific buffer objects, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21990?
CVE-2025-21990 is a medium-severity vulnerability in Linux kernel, published on 2 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Check for that before dereferencing.
(cherry picked from commit 3e3fcd29b505cebed659311337ea03b7698767fc)
Weakness: CWE-476
Which versions are affected by CVE-2025-21990?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21990?
Apply the vendor's patch.
Is CVE-2025-21990 being exploited?
There is no known exploitation of CVE-2025-21990 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21990, DEBIAN-CVE-2025-21990, GHSA-w8hh-wp8f-6m6v, UBUNTU-CVE-2025-21990.