CVE-2020-25639

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-04 · updated 2026-10-08
Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.

Affected products

Fedoraproject Fedora: 32, 33
Linux kernel: through 5.11.2
Red Hat Enterprise Linux: 5.0, 6.0, 7.0, 8.0
RedHat Messaging Realtime Grid: 2.0
Red Hat OpenShift Container Platform 4.18: 4.4, 4.5, 4.6

References

https://bugzilla.redhat.com/show_bug.cgi?id=1876995
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE4CT3NL6OEBRRBUKHIX63GLNVOWCVRW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUCBCKRHWP3UD2AVVYQJE7BIJEMCMXW5/
https://bugzilla.redhat.com/show_bug.cgi?id=1876995
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE4CT3NL6OEBRRBUKHIX63GLNVOWCVRW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUCBCKRHWP3UD2AVVYQJE7BIJEMCMXW5/

Get alerted when CVE-2020-25639 or the next vulnerability affects your stack