Kernel Crash Vulnerability in Linux Package: drm/imagination GPU Reset Issue
Summary
DEBIAN-CVE-2025-38521: In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix kernel crash when hard resetting the GPU The GPU hard reset sequence calls pm_runtime_force_suspend() and pm_runtime_force_resume()... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It includes drivers for various hardware, including graphics processing units (GPUs). The vulnerability in question arises from improper handling of GPU hard reset sequences, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/imagination subsystem that can cause a kernel crash during GPU hard resets. The issue stems from the use of pm_runtime_force_suspend() and pm_runtime_force_resume() functions, which are intended for system-wide power management transitions. If the internal runtime PM state indicates that the usage count is less than or equal to 1, pm_runtime_force_resume() may not resume the GPU correctly, leading to a failure to re-enable GPU clocks. This results in a kernel crash when the system attempts to access GPU registers during the power-on sequence.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the GPU hard reset sequence until the package is updated. This may involve modifying application settings or avoiding specific operations that lead to GPU resets.
Conclusion
The vulnerability in the Linux package related to GPU hard reset sequences poses a significant risk of kernel crashes. Users are advised to update to the latest patched versions to mitigate this risk. Temporary workarounds are available, but the best course of action is to apply the updates as soon as possible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes, resulting in system instability and potential data loss.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, updating to the patched versions of the Linux package will resolve the vulnerability.
If an immediate update is not possible, consider applying the workaround by avoiding GPU hard resets.
Detailed information can be found in the Debian CVE database and the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
