What’s Vulnerable › Vulnerabilities

CVE-2025-21987: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-02 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer Otherwise an uninitialized value can be returned if amdgpu_res_cleared returns true for all regions. Possibly closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 (cherry picked from commit 7c62aacc3b452f73a1284198c81551035fac6d71)

Affected products

• Linux kernel: from 6.10 before 6.12.18; from 6.13 before 6.13.6; 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4 — fixed in 6.12.18, 6.13.6

How to fix

Upgrade to a fixed version: Linux kernel 6.12.18, 6.13.6. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5bd98c2df4a0f2e2dcbdf563feb8d348406377b5
• https://git.kernel.org/stable/c/d2c9625b0ade41f9917875d88173a0cc802b95fc
• https://git.kernel.org/stable/c/d3c7059b6a8600fc62cd863f1ea203b8675e63e1

Get alerted when CVE-2025-21987 or the next vulnerability affects your stack