CVE-2025-21996

What it actually does

Uninitialized 'tmp' variable passed as size to radeon_vce_cs_reloc() inside radeon_vce_cs_parse() when userspace supplies a command stream whose first command is the encode case (0x03000001), allowing use of garbage values in subsequent memory operations.

Why it matters to the business

Local users on systems with Radeon GPUs can trigger kernel instability or memory corruption, potentially leading to crashes or privilege escalation on affected Linux deployments.

How an attack unfolds

An attacker crafts a malicious VCE command stream and submits it via the radeon ioctl path; when the first command matches 0x03000001 the uninitialized size reaches radeon_vce_cs_reloc(), which may dereference invalid memory or bypass safety checks.

How to fix it

Upgrade the Linux kernel to commit 0effb378ebce52b897f85cd7f828854b8c7cb636 or later; for the listed Red Hat packages apply the fixed versions 2:2.2.0-1.el8.

How to confirm the fix worked

Confirm the patch is present by inspecting radeon_vce_cs_parse() to ensure 'tmp' is initialized to 0 before any call to radeon_vce_cs_reloc(), or verify the git commit hash is in the running kernel tree.

Typical attack path

1. Craft ioctl command stream starting with encode command 0x03000001
2. Invoke radeon_vce_cs_parse from userspace
3. Trigger use of uninitialized 'tmp' size argument
4. Reach memory operation with attacker-controlled or garbage size

How to detect it

Review kernel logs for oops or warnings originating from radeon_vce_cs_parse or radeon_vce_cs_reloc; look for unusual patterns of VCE ioctl submissions from untrusted processes.

What your security team should do

• Apply the kernel fix or package updates immediately on all systems with Radeon hardware
• Restrict unprivileged access to the radeon ioctl interface where possible
• Monitor kernel logs for radeon VCE related faults