Critical NULL Pointer Dereference in Linux Kernel's AMDGPU Driver - linux Package
Summary
DEBIAN-CVE-2025-21989: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, due to lack of .is_two... Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel which serves as the foundation for system operations. It manages hardware resources, facilitates communication between software and hardware, and ensures system stability. The kernel is crucial for system performance and security, making it essential to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMDGPU driver related to the handling of the .is_two_pixels_per_container function. This issue, introduced in version 6.11, can lead to a NULL pointer dereference when the driver is loaded with the amdgpu.dc=1 option on older GPUs, such as the R9 280X. This can result in system crashes or instability, impacting users relying on these older graphics cards.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the amdgpu.dc=1 option when loading the AMDGPU driver. This can be done by modifying the boot parameters in the GRUB configuration file. Edit the file '/etc/default/grub' and change the line: 'GRUB_CMDLINE_LINUX_DEFAULT' to remove 'amdgpu.dc=1'. After making changes, run 'sudo update-grub' and reboot the system.
Conclusion
The identified vulnerability in the Linux kernel's AMDGPU driver poses a significant risk to users with older GPUs. It is crucial to update the linux package to the patched version to ensure system stability and security. Users should also consider using the provided workaround if immediate updates are not feasible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability on PCs with older GPUs, affecting user experience and system reliability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, updating the linux package to version 6.12.20-1 or later will permanently resolve the vulnerability.
If you cannot update, consider using the workaround by disabling the amdgpu.dc=1 option to mitigate the risk temporarily.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21989.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
