Security readout for executives and security teams
Plain-English summary
This is a Linux kernel AMDGPU display bug that can crash affected systems when the driver loads on older AMD graphics hardware. The business impact is availability, not data theft. It is local-only and requires low privileges, so prioritize exposed workstations or servers with AMD GPUs rather than internet-facing services.
Executive priority
Treat as a targeted availability issue for Linux endpoints or systems with older AMD graphics hardware. It should be patched through normal kernel maintenance, faster where crashes would disrupt operations.
Technical view
CVE-2025-21989 is a CWE-476 NULL pointer dereference in drm/amd/display. Starting with Linux 6.11, amdgpu with amdgpu.dc=1 may dereference a missing .is_two_pixels_per_container function in dce60_tg_funcs on older GPUs such as Radeon R9 280X. The referenced stable commits add the missing function.
Likely exposure
Exposure is likely limited to Linux systems running affected 6.11-era or later kernels with AMDGPU display core enabled and older AMD GPUs. Distro kernel backports may change exact exposure, so package-level vendor advisories should be checked.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction, and high availability impact. The source bundle does not show CISA KEV listing or cited evidence of active exploitation.
Researcher notes
The record ties the flaw to a missing function pointer in dce60_tg_funcs and states the regression starts from Linux 6.11. Public evidence in the bundle supports local denial of service only; it does not support remote compromise, data exposure, or confirmed exploitation.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fix commits.
- Check Linux distribution advisories for CVE-2025-21989 package status.
- Prioritize older AMD GPU systems using the AMDGPU driver.
- Avoid relying on unconfirmed boot-parameter workarounds without vendor guidance.
Validation and detection
- Inventory Linux hosts with AMDGPU hardware, especially older Radeon cards.
- Check kernel versions and distro patch status against CVE-2025-21989.
- Review boot parameters for amdgpu.dc=1 where applicable.
- Look for kernel crash logs referencing AMD display NULL pointer dereferences.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21989 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fefa811e616b5d0b555ed65743e528a0a8a0b377CVE reference, Linux
- https://git.kernel.org/stable/c/36d04c9313d8d83ead92242f037099ac73e02120CVE reference, Linux
- https://git.kernel.org/stable/c/e204aab79e01bc8ff750645666993ed8b719de57CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.