logo_clicknbuy.png

CVE-2025-21976 – Linux Kernel Hyper-V framebuffer Unbind Information Leak

The following table lists the changes that have been made to the
CVE-2025-21976 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 01, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    fbdev: hyperv_fb: Allow graceful removal of framebuffer

    When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to
    release the framebuffer forcefully. If this framebuffer is in use it
    produce the following WARN and hence this framebuffer is never released.

    [ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40

    [ 44.111289] Call Trace:
    [ 44.111290]
    [ 44.111291] ? show_regs+0x6c/0x80
    [ 44.111295] ? __warn+0x8d/0x150
    [ 44.111298] ? framebuffer_release+0x2c/0x40
    [ 44.111300] ? report_bug+0x182/0x1b0
    [ 44.111303] ? handle_bug+0x6e/0xb0
    [ 44.111306] ? exc_invalid_op+0x18/0x80
    [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20
    [ 44.111311] ? framebuffer_release+0x2c/0x40
    [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb]
    [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus]
    [ 44.111323] device_remove+0x40/0x80
    [ 44.111325] device_release_driver_internal+0x20b/0x270
    [ 44.111327] ? bus_find_device+0xb3/0xf0

    Fix this by moving the release of framebuffer and assosiated memory
    to fb_ops.fb_destroy function, so that framebuffer framework handles
    it gracefully.

    While we fix this, also replace manual registrations/unregistration of
    framebuffer with devm_register_framebuffer.
    Added Reference https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a
    Added Reference https://git.kernel.org/stable/c/a7b583dc99c6cf4a96877017be1d08247e1ef2c7
    Added Reference https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb
Share the Post:

Related Posts