{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-21688",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-21688",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-02-10T15:58:44.717Z",
    "updatedAt": "2026-05-23T15:56:53.872Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "drm/v3d: Assign job pointer to NULL before signaling the fence",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Assign job pointer to NULL before signaling the fence\n\nIn commit e4b5ccd392b9 (\"drm/v3d: Ensure job pointer is set to NULL\nafter job completion\"), we introduced a change to assign the job pointer\nto NULL after completing a job, indicating job completion.\n\nHowever, this approach created a race condition between the DRM\nscheduler workqueue and the IRQ execution thread. As soon as the fence is\nsignaled in the IRQ execution thread, a new job starts to be executed.\nThis results in a race condition where the IRQ execution thread sets the\njob pointer to NULL simultaneously as the `run_job()` function assigns\na new job to the pointer.\n\nThis race condition can lead to a NULL pointer dereference if the IRQ\nexecution thread sets the job pointer to NULL after `run_job()` assigns\nit to the new job. When the new job completes and the GPU emits an\ninterrupt, `v3d_irq()` is triggered, potentially causing a crash.\n\n[  466.310099] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0\n[  466.318928] Mem abort info:\n[  466.321723]   ESR = 0x0000000096000005\n[  466.325479]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  466.330807]   SET = 0, FnV = 0\n[  466.333864]   EA = 0, S1PTW = 0\n[  466.337010]   FSC = 0x05: level 1 translation fault\n[  466.341900] Data abort info:\n[  466.344783]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[  466.350285]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[  466.355350]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[  466.360677] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000089772000\n[  466.367140] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[  466.375875] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[  466.382163] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep binfmt_misc vc4 snd_soc_hdmi_codec drm_display_helper cec brcmfmac_wcc spidev rpivid_hevc(C) drm_client_lib brcmfmac hci_uart drm_dma_helper pisp_be btbcm brcmutil snd_soc_core aes_ce_blk v4l2_mem2mem bluetooth aes_ce_cipher snd_compress videobuf2_dma_contig ghash_ce cfg80211 gf128mul snd_pcm_dmaengine videobuf2_memops ecdh_generic sha2_ce ecc videobuf2_v4l2 snd_pcm v3d sha256_arm64 rfkill videodev snd_timer sha1_ce libaes gpu_sched snd videobuf2_common sha1_generic drm_shmem_helper mc rp1_pio drm_kms_helper raspberrypi_hwmon spi_bcm2835 gpio_keys i2c_brcmstb rp1 raspberrypi_gpiomem rp1_mailbox rp1_adc nvmem_rmem uio_pdrv_genirq uio i2c_dev drm ledtrig_pattern drm_panel_orientation_quirks backlight fuse dm_mod ip_tables x_tables ipv6\n[  466.458429] CPU: 0 UID: 1000 PID: 2008 Comm: chromium Tainted: G         C         6.13.0-v8+ #18\n[  466.467336] Tainted: [C]=CRAP\n[  466.470306] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)\n[  466.476157] pstate: 404000c9 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  466.483143] pc : v3d_irq+0x118/0x2e0 [v3d]\n[  466.487258] lr : __handle_irq_event_percpu+0x60/0x228\n[  466.492327] sp : ffffffc080003ea0\n[  466.495646] x29: ffffffc080003ea0 x28: ffffff80c0c94200 x27: 0000000000000000\n[  466.502807] x26: ffffffd08dd81d7b x25: ffffff80c0c94200 x24: ffffff8003bdc200\n[  466.509969] x23: 0000000000000001 x22: 00000000000000a7 x21: 0000000000000000\n[  466.517130] x20: ffffff8041bb0000 x19: 0000000000000001 x18: 0000000000000000\n[  466.524291] x17: ffffffafadfb0000 x16: ffffffc080000000 x15: 0000000000000000\n[  466.531452] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  466.538613] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffd08c527eb0\n[  466.545777] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\n[  466.552941] x5 : ffffffd08c4100d0 x4 : ffffffafadfb0000 x3 : ffffffc080003f70\n[  466.560102] x2 : ffffffc0829e8058 x1 : 0000000000000001 x0 : 0000000000000000\n[  466.567263] Call trace:\n[  466.569711]  v3d_irq+0x118/0x2e0 [v3d] (P)\n[  466.\n---truncated---",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1bd6303d08c85072ce40ac01a767ab67195105bd",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9793206fbf5293534c3a79d78f196e2cbb48c22d"
            },
            {
              "version": "a34050f70e7955a359874dff1a912a748724a140",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1f66a3a1a516e4d545906916b3f3c8d1c5e909e6"
            },
            {
              "version": "14e0a874488e79086340ba8e2d238cb9596b68a8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6cfafcad46e95351c477da0ae7e3acb8f7550ada"
            },
            {
              "version": "2a1c88f7ca5c12dff6fa6787492ac910bb9e4407",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a9401cd5d1bb5a0b8d2bef09623ca43551cd6e8a"
            },
            {
              "version": "63195bae1cbf78f1d392b1bc9ae4b03c82d0ebf3",
              "status": "affected",
              "versionType": "git",
              "lessThan": "431fb709db434565b5e7cee82a11bd681a794fd3"
            },
            {
              "version": "b22467b1ae104073dcb11aa78562a331cd7fb0e0",
              "status": "affected",
              "versionType": "git",
              "lessThan": "01a7e3a43ee2e6607169a75889412344c10b37fd"
            },
            {
              "version": "e4b5ccd392b92300a2b341705cc4805681094e49",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3059e7aaa280daea57bb069fbc65225e1bb95014"
            },
            {
              "version": "e4b5ccd392b92300a2b341705cc4805681094e49",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6e64d6b3a3c39655de56682ec83e894978d23412"
            },
            {
              "version": "5.15.177",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.15.178"
            },
            {
              "version": "6.1.127",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.128"
            },
            {
              "version": "6.6.74",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.75"
            },
            {
              "version": "6.12.11",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12.12"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.13",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.13"
            },
            {
              "version": "5.15.178",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.128",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.75",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.12",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.13.1",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "version": "6.14",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}