CVE-2025-21688

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Assign job pointer to NULL before signaling the fence

In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL

after job completion"), we introduced a change to assign the job pointer

to NULL after completing a job, indicating job completion.

However, this approach created a race condition between the DRM

scheduler workqueue and the IRQ execution thread. As soon as the fence is

signaled in the IRQ execution thread, a new job starts to be executed.

This results in a race condition where the IRQ execution thread sets the

job pointer to NULL simultaneously as the `run_job()` function assigns

a new job to the pointer.

This race condition can lead to a NULL pointer dereference if the IRQ

execution thread sets the job pointer to NULL after `run_job()` assigns

it to the new job. When the new job completes and the GPU emits an

interrupt, `v3d_irq()` is triggered, potentially causing a crash.

[ 466.310

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References