#VU106963 Use of uninitialized resource in Linux kernel - CVE-2025-21996

Vulnerability identifier: #VU106963

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21996

CWE-ID: CWE-908

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the radeon_vce_cs_parse() function in drivers/gpu/drm/radeon/radeon_vce.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.13, 6.13.1, 6.13.2, 6.13.3, 6.13.4, 6.13.5, 6.13.6, 6.13.7, 6.13.8

---

External links
https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8
https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69
https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713
https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c
https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.9

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.