{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21976","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.798Z","datePublished":"2025-04-01T15:47:07.120Z","dateUpdated":"2026-08-05T11:55:48.624Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:55:48.624Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: hyperv_fb: Allow graceful removal of framebuffer\n\nWhen a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to\nrelease the framebuffer forcefully. If this framebuffer is in use it\nproduce the following WARN and hence this framebuffer is never released.\n\n[   44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40\n< snip >\n[   44.111289] Call Trace:\n[   44.111290]  <TASK>\n[   44.111291]  ? show_regs+0x6c/0x80\n[   44.111295]  ? __warn+0x8d/0x150\n[   44.111298]  ? framebuffer_release+0x2c/0x40\n[   44.111300]  ? report_bug+0x182/0x1b0\n[   44.111303]  ? handle_bug+0x6e/0xb0\n[   44.111306]  ? exc_invalid_op+0x18/0x80\n[   44.111308]  ? asm_exc_invalid_op+0x1b/0x20\n[   44.111311]  ? framebuffer_release+0x2c/0x40\n[   44.111313]  ? hvfb_remove+0x86/0xa0 [hyperv_fb]\n[   44.111315]  vmbus_remove+0x24/0x40 [hv_vmbus]\n[   44.111323]  device_remove+0x40/0x80\n[   44.111325]  device_release_driver_internal+0x20b/0x270\n[   44.111327]  ? bus_find_device+0xb3/0xf0\n\nFix this by moving the release of framebuffer and assosiated memory\nto fb_ops.fb_destroy function, so that framebuffer framework handles\nit gracefully.\n\nWhile we fix this, also replace manual registrations/unregistration of\nframebuffer with devm_register_framebuffer."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through local interfaces only — opening and mmap'ing the `/dev/fbN` character device and the local/administrative device-removal path (sysfs unbind, module unload, or VMBus rescind of the guest's synthetic video device). No network or adjacent-network vector exists for hyperv_fb.\nAC:L - There is no race to win: a process simply holds an mmap of `/dev/fb0`, and the premature `vfree()`/`kvfree()` in `hvfb_remove()` deterministically leaves that mapping and the `info->pagerefs` array pointing at freed memory. Grooming the recycled pages afterwards is under the attacker's control via ordinary allocation pressure.\nPR:L - The party that gains the freed-memory read/write primitive only needs to open and mmap the framebuffer device, which unprivileged seat/console users (logind ACLs), `video`-group members, and graphics-domain processes on embedded/Android-style systems routinely can do. No CAP_SYS_ADMIN is needed to hold the mapping that survives the teardown.\nUI:N - The removal that triggers the free is a device/administrative event — Hyper-V host-side rescind of the video VMBus device, driver reload during a package update, or automated unbind — not an action by a victim user, and the attacking process merely has to be mapped when it occurs. This matches the treatment of the identical fbdev hot-unplug-while-mapped class.\nS:U - The corrupted resources (vmalloc pages, the deferred-I/O pageref array, the leaked `fb_info`) are all kernel memory managed by the same security authority as the vulnerable driver. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - After `vfree(par->dio_vp)` the surviving userspace mapping still points at pages handed back to the page allocator, so the attacker can read whatever kernel data those pages are subsequently reused for — slab objects, page tables, credentials — an effectively arbitrary kernel memory disclosure.\nI:H - The same surviving mapping is writable, giving a page-granularity write primitive into recycled kernel memory, and write faults additionally corrupt the kvfree'd `info->pagerefs` array and lock a destroyed mutex. That combination is a classic path to heap/page-table corruption and control-flow hijack.\nA:H - Unbind with the framebuffer in use produces a `WARN_ON` in `framebuffer_release()` (fatal under panic_on_warn) plus an `fb_info` leak, and subsequent access from the still-open fd faults on freed vmalloc memory, walks a freed pageref array, and locks a destroyed mutex — resulting in oops/panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/hyperv_fb.c"],"versions":[{"version":"68a2d20b79b105f02dcbc52c211d7e62f98996b7","lessThan":"4545e2aa121aea304d33903099c03e29ed4fe50a","status":"affected","versionType":"git"},{"version":"68a2d20b79b105f02dcbc52c211d7e62f98996b7","lessThan":"a7b583dc99c6cf4a96877017be1d08247e1ef2c7","status":"affected","versionType":"git"},{"version":"68a2d20b79b105f02dcbc52c211d7e62f98996b7","lessThan":"ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/hyperv_fb.c"],"versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","status":"unaffected","versionType":"semver"},{"version":"6.12.20","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.8","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.12.20"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.13.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a"},{"url":"https://git.kernel.org/stable/c/a7b583dc99c6cf4a96877017be1d08247e1ef2c7"},{"url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","x_generator":{"engine":"bippy-1.2.0"}}}}