CVE-2025-38521
BaseFortify
Publication date: 2025-08-16
Last updated on: 2026-01-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.8 (inc) to 6.12.39 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.7 (exc) |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-668 | The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a kernel crash issue in the Linux kernel related to the GPU hard reset sequence in the drm/imagination driver. The problem arises because the GPU hard reset calls pm_runtime_force_suspend() and pm_runtime_force_resume(), which are intended only for system-wide power management transitions. Depending on the internal runtime PM state, pm_runtime_force_resume() might not resume the device, causing the GPU clocks not to be re-enabled. As a result, when the kernel next tries to access GPU registers during power-on, it crashes. The fix replaces these calls with direct calls to the driver's runtime PM callbacks to ensure the GPU clocks are properly re-enabled and prevent the crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash when the GPU is hard reset, leading to system instability or downtime. This could interrupt normal operations, cause data loss, or require system reboots, impacting system reliability and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the drm/imagination driver replaces calls to pm_runtime_force_suspend() and pm_runtime_force_resume() with direct calls to the driver's runtime PM callbacks pvr_power_device_suspend() and pvr_power_device_resume(). This ensures the GPU clocks are properly re-enabled and prevents kernel crashes during GPU hard reset sequences.