---
id: CVE-2025-21976
title: 'fbdev: hyperv_fb: Allow graceful removal of framebuffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: hyperv_fb: Allow graceful removal of framebuffer

  When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to
  release the framebuffer forcefully. If t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 <
    b1a86a5ab0d44160534f495a3630646092d98e27
  - >-
    Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 <
    4545e2aa121aea304d33903099c03e29ed4fe50a
  - >-
    Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 <
    a7b583dc99c6cf4a96877017be1d08247e1ef2c7
  - >-
    Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 <
    ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:43:57.399849Z'
published: '2025-04-01'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:12.299Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21976'
references:
  - url: 'https://git.kernel.org/stable/c/b1a86a5ab0d44160534f495a3630646092d98e27'
  - url: 'https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a'
  - url: 'https://git.kernel.org/stable/c/a7b583dc99c6cf4a96877017be1d08247e1ef2c7'
  - url: 'https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb'
tags:
  - cve.org
epss: 0.00258
epssPercentile: 0.17367
ingestedAt: '2026-10-15T22:48:25.471Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: hyperv_fb: Allow graceful removal of framebuffer

When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to
release the framebuffer forcefully. If this framebuffer is in use it
produce the following WARN and hence this framebuffer is never released.

[   44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40
< snip >
[   44.111289] Call Trace:
[   44.111290]  <TASK>
[   44.111291]  ? show_regs+0x6c/0x80
[   44.111295]  ? __warn+0x8d/0x150
[   44.111298]  ? framebuffer_release+0x2c/0x40
[   44.111300]  ? report_bug+0x182/0x1b0
[   44.111303]  ? handle_bug+0x6e/0xb0
[   44.111306]  ? exc_invalid_op+0x18/0x80
[   44.111308]  ? asm_exc_invalid_op+0x1b/0x20
[   44.111311]  ? framebuffer_release+0x2c/0x40
[   44.111313]  ? hvfb_remove+0x86/0xa0 [hyperv_fb]
[   44.111315]  vmbus_remove+0x24/0x40 [hv_vmbus]
[   44.111323]  device_remove+0x40/0x80
[   44.111325]  device_release_driver_internal+0x20b/0x270
[   44.111327]  ? bus_find_device+0xb3/0xf0

Fix this by moving the release of framebuffer and assosiated memory
to fb_ops.fb_destroy function, so that framebuffer framework handles
it gracefully.

While we fix this, also replace manual registrations/unregistration of
framebuffer with devm_register_framebuffer.

## Affected

- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < b1a86a5ab0d44160534f495a3630646092d98e27`
- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < 4545e2aa121aea304d33903099c03e29ed4fe50a`
- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < a7b583dc99c6cf4a96877017be1d08247e1ef2c7`
- `Linux >= 68a2d20b79b105f02dcbc52c211d7e62f98996b7 < ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.