CVE-2025-21688

Summary

CVE-2025-21688 is a vulnerability in the Linux kernel's V3D driver that can lead to a NULL pointer dereference. The issue arises due to a race condition between the DRM scheduler workqueue and the IRQ execution thread. When a new job starts to be executed after the fence is signaled in the IRQ execution thread, both threads try to set the job pointer to NULL, resulting in a race condition that can cause a crash. The vulnerability is described in commit e4b5ccd392b9, where a change was made to assign the job pointer to NULL after completing a job, but this approach inadvertently created the race condition. The consequence of this vulnerability is a kernel NULL pointer dereference, which can cause the system to crash.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.