CVE-2025-21996

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

State: Published
Severity: 5.5 Medium
Published: Apr 3, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value.

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
LinuxLinux	2fc5703abda201f138faf63bdca743d04dbf4b1a to before 0effb378ebce52b897f85cd7f828854b8c7cb636Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before 5b4d9d20fd455a97920cf158dd19163b879cf65dAffected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before 9b2da9c673a0da1359a2151f7ce773e2f77d71a9Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before 78b07dada3f02f77762d0755a96d35f53b02be69Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before 3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before dd1801aa01bba1760357f2a641346ae149686713Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before f5e049028124f755283f2c07e7a3708361ed1dc8Affected 2fc5703abda201f138faf63bdca743d04dbf4b1a to before dd8689b52a24807c2d5ce0a17cb26dc87f75235cAffected
LinuxLinux	3.15Affected before 3.15Not affected 5.4.292 through 5.4.Not affected 5.10.236 through 5.10.Not affected 5.15.180 through 5.15.Not affected 6.1.132 through 6.1.Not affected 6.6.85 through 6.6.Not affected 6.12.21 through 6.12.Not affected 6.13.9 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

2fc5703abda201f138faf63bdca743d04dbf4b1a to before 0effb378ebce52b897f85cd7f828854b8c7cb636Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before 5b4d9d20fd455a97920cf158dd19163b879cf65dAffected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before 9b2da9c673a0da1359a2151f7ce773e2f77d71a9Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before 78b07dada3f02f77762d0755a96d35f53b02be69Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before 3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before dd1801aa01bba1760357f2a641346ae149686713Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before f5e049028124f755283f2c07e7a3708361ed1dc8Affected
2fc5703abda201f138faf63bdca743d04dbf4b1a to before dd8689b52a24807c2d5ce0a17cb26dc87f75235cAffected

LinuxLinux

3.15Affected
before 3.15Not affected
5.4.292 through 5.4.*Not affected
5.10.236 through 5.10.*Not affected
5.15.180 through 5.15.*Not affected
6.1.132 through 6.1.*Not affected
6.6.85 through 6.6.*Not affected
6.12.21 through 6.12.*Not affected
6.13.9 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.