Critical Vulnerability in Linux Kernel: NULL-check Issue in AMD GPU Handling
Summary
DEBIAN-CVE-2025-21990: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is crucial for system stability and performance. This vulnerability specifically affects the AMD GPU driver within the kernel, which is responsible for managing graphics processing units. The issue arises when certain buffer objects (BOs) lack a backing store, leading to potential system crashes or undefined behavior.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD GPU driver where the code fails to check if a buffer object's backing store is NULL before dereferencing it. This can lead to dereferencing a NULL pointer, which may cause system crashes or unpredictable behavior. The issue was introduced in earlier versions of the kernel and has been addressed in a subsequent patch. The vulnerability is critical as it can affect system stability and security, particularly in environments relying on AMD graphics hardware.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's AMD GPU driver poses significant risks to system stability and security. Users are strongly advised to update to the patched version to safeguard their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a NULL pointer dereference in the AMD GPU driver of the Linux kernel, which can lead to system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected.
Yes, the vulnerability has been patched in version 6.12.20-1 of the Linux kernel.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21990.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
