CVE-2025-21976 in Linux
Summary
by MITRE • 04/01/2025
In the Linux kernel, the following vulnerability has been resolved:
fbdev: hyperv_fb: Allow graceful removal of framebuffer
When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released.
[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40
< snip > [ 44.111289] Call Trace:
[ 44.111290] <TASK>
[ 44.111291] ? show_regs+0x6c/0x80
[ 44.111295] ? __warn+0x8d/0x150
[ 44.111298] ? framebuffer_release+0x2c/0x40
[ 44.111300] ? report_bug+0x182/0x1b0
[ 44.111303] ? handle_bug+0x6e/0xb0
[ 44.111306] ? exc_invalid_op+0x18/0x80
[ 44.111308] ? asm_exc_invalid_op+0x1b/0x20
[ 44.111311] ? framebuffer_release+0x2c/0x40
[ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb]
[ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus]
[ 44.111323] device_remove+0x40/0x80
[ 44.111325] device_release_driver_internal+0x20b/0x270
[ 44.111327] ? bus_find_device+0xb3/0xf0
Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework handles it gracefully.
While we fix this, also replace manual registrations/unregistration of framebuffer with devm_register_framebuffer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/01/2026
The vulnerability CVE-2025-21976 affects the Linux kernel's Hyper-V framebuffer driver implementation, specifically within the hyperv_fb module. This issue manifests when a Hyper-V framebuffer device undergoes unbinding operations, creating a scenario where the driver attempts to forcefully release the framebuffer without proper consideration of its current usage state. The underlying problem stems from improper resource management during device removal, where the driver's attempt to clean up framebuffer resources triggers kernel warnings and prevents successful deallocation, ultimately leading to resource leaks that could impact system stability and performance.
The technical flaw resides in the hyperv_fb driver's handling of framebuffer cleanup operations during device removal. When the vmbus_remove function is invoked during unbinding, it attempts to release the framebuffer through direct kernel mechanisms rather than following the proper framebuffer framework protocols. This approach fails to account for potential ongoing usage of the framebuffer, causing the framebuffer_release function to trigger a WARNING message at drivers/video/fbdev/core/fb_info.c:70. The call trace demonstrates the execution path leading to this failure, showing how hvfb_remove calls vmbus_remove which then attempts to remove the device and subsequently fails during the framebuffer release phase. This represents a violation of proper resource lifecycle management principles that should be enforced by the framebuffer subsystem.
The operational impact of this vulnerability extends beyond simple resource leakage, potentially affecting system stability and performance in virtualized environments running on Hyper-V platforms. When framebuffers cannot be properly released, they remain allocated in memory even after the device has been unbound, leading to gradual resource exhaustion over time. This issue particularly affects systems where Hyper-V framebuffer devices are frequently bound and unbound during dynamic virtual machine operations, such as during live migration scenarios or when managing multiple virtual machines on the same host. The improper handling of framebuffer resources can also interfere with subsequent device initialization attempts, potentially causing system hangs or requiring manual intervention to recover from the resource leak conditions.
The fix implemented for CVE-2025-21976 addresses the root cause by restructuring the framebuffer cleanup process to align with proper kernel framework practices. The solution involves moving the framebuffer and associated memory release operations to the fb_ops.fb_destroy function, allowing the framebuffer framework to handle the cleanup gracefully through established protocols rather than attempting forceful removal. This approach leverages the existing kernel infrastructure designed to manage framebuffer lifecycle events properly, ensuring that resources are only released when it is safe to do so. Additionally, the patch replaces manual framebuffer registration and unregistration processes with the devm_register_framebuffer function, which provides automatic cleanup through the device management framework, aligning with the principle of using kernel-provided resource management mechanisms rather than implementing custom cleanup logic that can lead to race conditions or improper state handling.
This vulnerability and its resolution demonstrate the importance of following established kernel development practices and framework guidelines, particularly when dealing with complex subsystems like framebuffer drivers. The fix aligns with common software security principles outlined in CWE categories related to resource management and improper cleanup operations, specifically CWE-404 for improper resource release and CWE-704 for incorrect use of kernel APIs. The implementation also reflects ATT&CK technique T1059.001 for command and scripting interpreter, as it involves proper handling of kernel-level operations through established interfaces rather than bypassing them. The solution represents a defensive programming approach that prevents resource leaks while maintaining system stability and proper device lifecycle management in virtualized environments.