Critical Vulnerability in Linux Package: Hyper-V Framebuffer Access Issue
Summary
DEBIAN-CVE-2025-21977: In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs Gen 2 Hyper-V VMs boot via EFI and have a standard EFI framebuffer device. Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing system resources and hardware interactions. It serves as the foundation for various applications and services, ensuring efficient operation of the system. This specific vulnerability affects the framebuffer management in Hyper-V Gen 2 virtual machines, leading to potential system hangs during kdump operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the framebuffer device (fbdev) related to the hyperv_fb driver. When running in Hyper-V Gen 2 VMs, the kdump kernel may hang due to incorrect framebuffer address access. This issue arises when the hyperv_fb driver moves the framebuffer to a different MMIO address, but the kdump kernel is unaware of this change. As a result, accessing a non-existent framebuffer address can lead to system throttling or apparent hangs, significantly affecting system stability and performance.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can use the kexec_load() system call to load the kdump kernel, which avoids the issue of incorrect framebuffer address access. This can be done by executing the following command: 'kexec -l /path/to/your/kernel --initrd=/path/to/your/initrd --reuse-cmdline'. This method builds the screen_info table in user space, preventing the hang issue.
Conclusion
The vulnerability in the Linux package related to framebuffer access in Hyper-V Gen 2 VMs poses significant risks to system stability. It is crucial to update to the patched version to mitigate these risks. Utilizing workarounds can provide temporary relief while waiting for updates.
See every vulnerability recorded for linux →
FAQ
The vulnerability can cause the kdump kernel to hang, leading to system performance degradation or complete unresponsiveness.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, updating to the patched version of the Linux package (6.12.20-1 or later) will permanently resolve the vulnerability.
If immediate updates are not possible, consider using the kexec_load() system call as a temporary workaround to avoid the hang issue.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21977.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
