CVE-2025-21989: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21989 is a vulnerability in the Linux kernel's AMDGPU driver that was discovered and disclosed on April 2, 2025. The issue affects Linux kernel versions from 6.11 up to versions before 6.12.20 and 6.13.8. The vulnerability stems from a missing .istwopixelspercontainer function in the dce60tgfuncs component of the AMD display driver (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that occurs when the AMDGPU driver is loaded with amdgpu.dc=1 parameter. The issue specifically affects systems with older GPUs, such as the R9 280X. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can cause a NULL pointer dereference on systems using older AMD GPUs, potentially leading to system crashes or denial of service. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability has been fixed by adding the missing .istwopixelspercontainer function to dce60tgfuncs. Patches have been released and are available through the Linux kernel repository. Users should upgrade to Linux kernel version 6.12.20 or later, or version 6.13.8 or later, depending on their kernel branch (Debian Tracker).