{"id":"CVE-2025-21976","title":"fbdev: hyperv_fb: Allow graceful removal of framebuffer","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: hyperv_fb: Allow graceful removal of framebuffer\n\nWhen a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to\nrelease the framebuffer forcefully. If t…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < b1a86a5ab0d44160534f495a3630646092d98e27","Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < 4545e2aa121aea304d33903099c03e29ed4fe50a","Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < a7b583dc99c6cf4a96877017be1d08247e1ef2c7","Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb","Linux 3.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:43:57.399849Z"},"published":"2025-04-01","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:36:12.299Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21976","references":[{"url":"https://git.kernel.org/stable/c/b1a86a5ab0d44160534f495a3630646092d98e27"},{"url":"https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a"},{"url":"https://git.kernel.org/stable/c/a7b583dc99c6cf4a96877017be1d08247e1ef2c7"},{"url":"https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"}],"tags":["cve.org"],"epss":0.00258,"epssPercentile":0.17367,"ingestedAt":"2026-10-15T22:48:25.471Z","slug":"CVE-2025-21976","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: hyperv_fb: Allow graceful removal of framebuffer\n\nWhen a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to\nrelease the framebuffer forcefully. If this framebuffer is in use it\nproduce the following WARN and hence this framebuffer is never released.\n\n[   44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40\n< snip >\n[   44.111289] Call Trace:\n[   44.111290]  <TASK>\n[   44.111291]  ? show_regs+0x6c/0x80\n[   44.111295]  ? __warn+0x8d/0x150\n[   44.111298]  ? framebuffer_release+0x2c/0x40\n[   44.111300]  ? report_bug+0x182/0x1b0\n[   44.111303]  ? handle_bug+0x6e/0xb0\n[   44.111306]  ? exc_invalid_op+0x18/0x80\n[   44.111308]  ? asm_exc_invalid_op+0x1b/0x20\n[   44.111311]  ? framebuffer_release+0x2c/0x40\n[   44.111313]  ? hvfb_remove+0x86/0xa0 [hyperv_fb]\n[   44.111315]  vmbus_remove+0x24/0x40 [hv_vmbus]\n[   44.111323]  device_remove+0x40/0x80\n[   44.111325]  device_release_driver_internal+0x20b/0x270\n[   44.111327]  ? bus_find_device+0xb3/0xf0\n\nFix this by moving the release of framebuffer and assosiated memory\nto fb_ops.fb_destroy function, so that framebuffer framework handles\nit gracefully.\n\nWhile we fix this, also replace manual registrations/unregistration of\nframebuffer with devm_register_framebuffer.\n\n## Affected\n\n- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < b1a86a5ab0d44160534f495a3630646092d98e27`\n- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < 4545e2aa121aea304d33903099c03e29ed4fe50a`\n- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < a7b583dc99c6cf4a96877017be1d08247e1ef2c7`\n- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb`\n- `Linux 3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}