[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2025-21688":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T03:17:55.401Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":21,"related":22,"reserved_at":9,"published_at":23,"modified_at":24,"state":9,"summary":25,"references_raw":27,"kevs":34,"epss":9,"epss_history":35,"metrics":36,"affected":43},"DEBIAN-CVE-2025-21688","In the Linux kernel, the following vulnerability has been resolved:  drm/v3d: Assign job pointer to NULL before signaling the fence  In commit e4b5ccd392b9 (\"drm/v3d: Ensure job pointer is set to NULL after job completion\"), we introduced a change to assign the job pointer to NULL after completing a job, indicating job completion.  However, this approach created a race condition between the DRM scheduler workqueue and the IRQ execution thread. As soon as the fence is signaled in the IRQ execution thread, a new job starts to be executed. This results in a race condition where the IRQ execution thread sets the job pointer to NULL simultaneously as the `run_job()` function assigns a new job to the pointer.  This race condition can lead to a NULL pointer dereference if the IRQ execution thread sets the job pointer to NULL after `run_job()` assigns it to the new job. When the new job completes and the GPU emits an interrupt, `v3d_irq()` is triggered, potentially causing a crash.  [  466.310099] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [  466.318928] Mem abort info: [  466.321723]   ESR = 0x0000000096000005 [  466.325479]   EC = 0x25: DABT (current EL), IL = 32 bits [  466.330807]   SET = 0, FnV = 0 [  466.333864]   EA = 0, S1PTW = 0 [  466.337010]   FSC = 0x05: level 1 translation fault [  466.341900] Data abort info: [  466.344783]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [  466.350285]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [  466.355350]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [  466.360677] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000089772000 [  466.367140] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [  466.375875] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [  466.382163] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep binfmt_misc vc4 snd_soc_hdmi_codec drm_display_helper cec brcmfmac_wcc spidev rpivid_hevc(C) drm_client_lib brcmfmac hci_uart drm_dma_helper pisp_be btbcm brcmutil snd_soc_core aes_ce_blk v4l2_mem2mem bluetooth aes_ce_cipher snd_compress videobuf2_dma_contig ghash_ce cfg80211 gf128mul snd_pcm_dmaengine videobuf2_memops ecdh_generic sha2_ce ecc videobuf2_v4l2 snd_pcm v3d sha256_arm64 rfkill videodev snd_timer sha1_ce libaes gpu_sched snd videobuf2_common sha1_generic drm_shmem_helper mc rp1_pio drm_kms_helper raspberrypi_hwmon spi_bcm2835 gpio_keys i2c_brcmstb rp1 raspberrypi_gpiomem rp1_mailbox rp1_adc nvmem_rmem uio_pdrv_genirq uio i2c_dev drm ledtrig_pattern drm_panel_orientation_quirks backlight fuse dm_mod ip_tables x_tables ipv6 [  466.458429] CPU: 0 UID: 1000 PID: 2008 Comm: chromium Tainted: G         C         6.13.0-v8+ #18 [  466.467336] Tainted: [C]=CRAP [  466.470306] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) [  466.476157] pstate: 404000c9 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  466.483143] pc : v3d_irq+0x118/0x2e0 [v3d] [  466.487258] lr : __handle_irq_event_percpu+0x60/0x228 [  466.492327] sp : ffffffc080003ea0 [  466.495646] x29: ffffffc080003ea0 x28: ffffff80c0c94200 x27: 0000000000000000 [  466.502807] x26: ffffffd08dd81d7b x25: ffffff80c0c94200 x24: ffffff8003bdc200 [  466.509969] x23: 0000000000000001 x22: 00000000000000a7 x21: 0000000000000000 [  466.517130] x20: ffffff8041bb0000 x19: 0000000000000001 x18: 0000000000000000 [  466.524291] x17: ffffffafadfb0000 x16: ffffffc080000000 x15: 0000000000000000 [  466.531452] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [  466.538613] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffd08c527eb0 [  466.545777] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 [  466.552941] x5 : ffffffd08c4100d0 x4 : ffffffafadfb0000 x3 : ffffffc080003f70 [  466.560102] x2 : ffffffc0829e8058 x1 : 0000000000000001 x0 : 0000000000000000 [  466.567263] Call trace: [  466.569711]  v3d_irq+0x118/0x2e0 [v3d] (P) [  466. ---truncated---",null,[],[],[],[14],{"_key":15},"CVE-2025-21688",[17,19],{"_key":18},"DLA-4075-1",{"_key":20},"DLA-4076-1",[],[],"2025-02-10T16:15:38.323Z","2026-06-15T19:05:20.400426075Z",{"cisa_kev":26,"cisa_ransomware":26,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[28],{"url":29,"sources":30,"tags":32},"https://security-tracker.debian.org/tracker/CVE-2025-21688",[31],"osv_debian",[33],"Advisory",[],[],[37],{"source":31,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":38,"cvss_v4_0":9},{"baseScore":39,"baseSeverity":9,"vectorString":40,"impactScore":41,"exploitabilityScore":42},4.7,"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",6,2.6,[44,63],{"ecosystem":45,"name":46,"vendor":47,"product":46,"cpe_part":9,"purl_type":48,"purl_namespace":47,"purl_name":46,"source":9,"versions":49},"Debian","linux","debian","deb",[50,56,59,62],{"version":51,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":55,"fixed_in":9},"lt5_10_234_1",true,"ecosystem","5.10.234-1","excluding",{"version":57,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":55,"fixed_in":9},"lt6_1_128_1","6.1.128-1",{"version":60,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},"lt6_12_12_1","6.12.12-1",{"version":60,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},{"ecosystem":45,"name":64,"vendor":47,"product":64,"cpe_part":9,"purl_type":48,"purl_namespace":47,"purl_name":64,"source":9,"versions":65},"linux-6.1",[66],{"version":67,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":68,"version_end_type":55,"fixed_in":9},"lt6_1_128_1~deb11u1","6.1.128-1~deb11u1"]