CVE-2025-21956

Q: What is the severity of CVE-2025-21956?

CVE-2025-21956 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a kernel warning in AMD GPU display drivers when handling 14-bit color depth. The vulnerability causes a warning message but doesn't appear to enable privilege escalation or remote code execution. It primarily affects Linux systems with AMD Radeon RX 6600 XT graphics cards.

5.5 MEDIUM

📋 TL;DR

This CVE addresses a kernel warning in AMD GPU display drivers when handling 14-bit color depth. The vulnerability causes a warning message but doesn't appear to enable privilege escalation or remote code execution. It primarily affects Linux systems with AMD Radeon RX 6600 XT graphics cards.

💻 Affected Systems

Products:

AMD Radeon RX 6600 XT graphics cards

Versions: Linux kernel versions with vulnerable AMD display driver code

Operating Systems: Linux distributions with AMD GPU drivers

Default Config Vulnerable: ⚠️ Yes

Notes: Only triggers when using 14-bit color depth (COLOR_DEPTH_141414), which may not be a common configuration

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system instability leading to denial of service

🟠

Likely Case

Warning messages in kernel logs and potential display artifacts or minor performance issues

🟢

If Mitigated

No impact beyond warning messages in logs

🌐 Internet-Facing: LOW - Requires local access to trigger, not remotely exploitable

🏢 Internal Only: LOW - Local user access required, minimal security impact

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific hardware and configuration

This appears to be a bug fix rather than a security vulnerability with exploit potential

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commit 274a87eb389f58eddcbc5659ab0b180b37e92775 or later stable backports

Vendor Advisory: https://git.kernel.org/stable/c/0174a2e5770efee9dbd4b58963ed4d939298ff5e

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Reboot system. 3. Verify AMD GPU driver loads without warnings.

🔧 Temporary Workarounds

Avoid 14-bit color depth

linux

Configure display settings to use standard color depths (8-bit, 10-bit, or 12-bit) instead of 14-bit

🧯 If You Can't Patch

Monitor kernel logs for warning messages and investigate any system instability
Consider using different graphics hardware if stability issues occur

🔍 How to Verify

Check if Vulnerable:

Check kernel logs for 'WARNING: CPU: ... calculate_phy_pix_clks+0xef/0x100 [amdgpu]' messages when using AMD GPU with 14-bit color depth

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commit and no warning messages appear in dmesg when using 14-bit color depth

📡 Detection & Monitoring

Log Indicators:

WARNING: CPU: ... calculate_phy_pix_clks+0xef/0x100 [amdgpu] in kernel logs

SIEM Query:

source="kernel" AND "calculate_phy_pix_clks" AND "amdgpu"

📊 Metadata

CVE ID: CVE-2025-21956

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.11% exploit probability (29.1th percentile)

Published: April 1, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Avoid 14-bit color depth

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export