---
id: CVE-2025-21978
title: 'drm/hyperv: Fix address space leak when Hyper-V DRM device is removed'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/hyperv: Fix address space leak when Hyper-V DRM device is removed

  When a Hyper-V DRM device is probed, the driver allocates MMIO space for
  the vram, and maps it ca…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 <
    c40cd24bfb9bfbb315c118ca14ebe6cf52e2dd1e
  - >-
    Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 <
    ad27b4a51495490b815580d9b935e8eee14d1a9c
  - >-
    Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 <
    24f1bbfb2be77dad82489c1468bbb14312aab129
  - >-
    Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 <
    158242b56bf465a73e1edeac0fe828a8acad4499
  - >-
    Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 <
    aed709355fd05ef747e1af24a1d5d78cd7feb81e
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:37:24.824735Z'
published: '2025-04-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:48.710Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21978'
references:
  - url: 'https://git.kernel.org/stable/c/c40cd24bfb9bfbb315c118ca14ebe6cf52e2dd1e'
  - url: 'https://git.kernel.org/stable/c/ad27b4a51495490b815580d9b935e8eee14d1a9c'
  - url: 'https://git.kernel.org/stable/c/24f1bbfb2be77dad82489c1468bbb14312aab129'
  - url: 'https://git.kernel.org/stable/c/158242b56bf465a73e1edeac0fe828a8acad4499'
  - url: 'https://git.kernel.org/stable/c/aed709355fd05ef747e1af24a1d5d78cd7feb81e'
tags:
  - cve.org
epss: 0.00194
epssPercentile: 0.09096
ingestedAt: '2026-11-05T22:38:31.858Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: Fix address space leak when Hyper-V DRM device is removed

When a Hyper-V DRM device is probed, the driver allocates MMIO space for
the vram, and maps it cacheable. If the device removed, or in the error
path for device probing, the MMIO space is released but no unmap is done.
Consequently the kernel address space for the mapping is leaked.

Fix this by adding iounmap() calls in the device removal path, and in the
error path during device probing.

## Affected

- `Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 < c40cd24bfb9bfbb315c118ca14ebe6cf52e2dd1e`
- `Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 < ad27b4a51495490b815580d9b935e8eee14d1a9c`
- `Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 < 24f1bbfb2be77dad82489c1468bbb14312aab129`
- `Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 < 158242b56bf465a73e1edeac0fe828a8acad4499`
- `Linux >= a0ab5abced550ddeefddb06055ed60779a54eb79 < aed709355fd05ef747e1af24a1d5d78cd7feb81e`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.