CVE-2025-21995

What it actually does

A reference count leak on the last_scheduled fence occurs when an entity is killed and dma_fence_add_callback fails, leaving the previous fence reference unbalanced.

Why it matters to the business

Prolonged operation on affected Linux kernels may result in gradual resource exhaustion within graphics or compute subsystems, increasing the risk of instability or denial of service on systems running Red Hat Enterprise Linux 8 components.

How an attack unfolds

An attacker triggers DRM scheduler entity destruction paths, forces a failure in callback registration during the kill sequence, and leverages the resulting unbalanced reference to corrupt memory state, potentially chaining with other kernel flaws for privilege escalation.

How to fix it

Upgrade all affected packages to the listed fixed versions, for example ipa to 0:4.9.2-3.module+el8.4.0+10412+5ecb5b37, ipa-server to the same, opendnssec to 0:2.1.7-1.module+el8.4.0+9007+5084bdd8, bind-dyndb-ldap to 0:11.6-2.module+el8.4.0+9328+4ec4e316, and the remaining packages to their corresponding fixed revisions.

How to confirm the fix worked

Confirm installed package versions meet or exceed the fixed revisions for each component and verify absence of the reference-count imbalance in kernel fence handling paths after update.

Typical attack path

1. Obtain local access or execute code that interacts with DRM entities
2. Trigger entity kill while inducing dma_fence_add_callback failure
3. Exploit leaked fence reference to achieve memory corruption
4. Escalate privileges using the corrupted kernel state

How to detect it

Inspect kernel logs and DRM scheduler traces for repeated entity-kill sequences accompanied by callback registration failures; correlate with memory-pressure indicators on systems using the affected kernel components.

What your security team should do

• Apply the exact fixed package versions across all Red Hat Enterprise Linux 8 systems without delay
• Prioritize patching of identity-management and related modules given their listed exposure
• Monitor kernel logs for DRM scheduler anomalies that could precede exploitation attempts
• Review downstream dependents and plan staged rollout to limit operational disruption