CVE-2025-21989: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21989 is a vulnerability in the Linux kernel's AMDGPU driver that was discovered and disclosed on April 2, 2025. The issue affects Linux kernel versions from 6.11 up to versions before 6.12.20 and 6.13.8. The vulnerability stems from a missing .is_two_pixels_per_container function in the dce60_tg_funcs component of the AMD display driver (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that occurs when the AMDGPU driver is loaded with amdgpu.dc=1 parameter. The issue specifically affects systems with older GPUs, such as the R9 280X. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can cause a NULL pointer dereference on systems using older AMD GPUs, potentially leading to system crashes or denial of service. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability requires local access and low attack complexity to exploit. An attacker would need local user privileges to trigger the vulnerability. The CVSS metrics indicate that no user interaction is required once an attacker has the necessary access (NVD).

The vulnerability has been fixed by adding the missing .is_two_pixels_per_container function to dce60_tg_funcs. Patches have been released and are available through the Linux kernel repository. Users should upgrade to Linux kernel version 6.12.20 or later, or version 6.13.8 or later, depending on their kernel branch (Debian Tracker).