Security readout for executives and security teams
Plain-English summary
CVE-2025-21688 is a Linux kernel bug in the Broadcom V3D graphics driver. A local user process can hit a timing race that dereferences a null job pointer and crashes the kernel. The cited impact is availability loss, not data theft or privilege escalation.
Executive priority
Treat this as a targeted availability issue, not a broad emergency. Patch affected Linux GPU systems in normal security maintenance, faster for shared, kiosk, lab, or multi-user devices where local users can run graphics workloads.
Technical view
The flaw is a CWE-362 race between the DRM scheduler workqueue and V3D IRQ handling. The IRQ path signaled a fence before clearing job state safely, allowing a new job assignment to race with NULL assignment. Later interrupt handling can dereference NULL in v3d_irq and trigger a kernel oops.
Likely exposure
Exposure is most likely on Linux systems using the v3d DRM driver, such as Raspberry Pi-class Broadcom V3D GPU platforms. The CVSS vector is local, high complexity, low privilege, no user interaction, with high availability impact only.
Exploitation context
The source bundle does not show KEV listing or active exploitation. Exploitation requires local access and successful timing of a race in GPU job completion and interrupt handling. Public evidence supports crash/denial-of-service risk, not remote compromise.
Researcher notes
The provided evidence is kernel-resolution text, stable commit references, and Debian LTS advisories. It identifies the race and crash path but does not provide proof of exploitation in the wild, exploit maturity, or non-Linux downstream product status.
Mitigation direction
- Update to a vendor kernel containing the referenced stable V3D fix.
- Apply Debian LTS kernel updates where those advisories apply.
- Prioritize systems exposing local GPU workloads to untrusted users.
- If updates are delayed, review vendor guidance for V3D driver risk reduction.
Validation and detection
- Inventory Linux hosts using the v3d kernel module.
- Compare running kernel packages against vendor advisories and stable commits.
- Review kernel logs for v3d_irq NULL dereference oops signatures.
- Confirm updated kernels boot and retain expected graphics functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21688 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9793206fbf5293534c3a79d78f196e2cbb48c22dCVE reference, Linux
- https://git.kernel.org/stable/c/1f66a3a1a516e4d545906916b3f3c8d1c5e909e6CVE reference, Linux
- https://git.kernel.org/stable/c/6cfafcad46e95351c477da0ae7e3acb8f7550adaCVE reference, Linux
- https://git.kernel.org/stable/c/a9401cd5d1bb5a0b8d2bef09623ca43551cd6e8aCVE reference, Linux
- https://git.kernel.org/stable/c/431fb709db434565b5e7cee82a11bd681a794fd3CVE reference, Linux
- https://git.kernel.org/stable/c/01a7e3a43ee2e6607169a75889412344c10b37fdCVE reference, Linux
- https://git.kernel.org/stable/c/3059e7aaa280daea57bb069fbc65225e1bb95014CVE reference, Linux
- https://git.kernel.org/stable/c/6e64d6b3a3c39655de56682ec83e894978d23412CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.