CVE-2025-38674
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the dma_buf field in the drm_gem_object structure becoming NULL when user space releases the final GEM handle on the buffer object. This leads to a NULL-pointer dereference because the dma_buf field is not stable over the object's lifetime. Previous partial fixes did not fully resolve the issue, especially for buffer objects without an associated DRM framebuffer. The vulnerability was fixed by reverting to using the .import_attach->dmabuf field instead.
How can this vulnerability impact me? :
The vulnerability can cause a NULL-pointer dereference in the Linux kernel's DRM subsystem, which may lead to system crashes or instability when handling certain graphics buffer objects. This could potentially be exploited to cause denial of service or other unintended behavior in systems using the affected kernel code.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability was resolved by reverting the commit that used dma_buf from GEM object instance and returning to using .import_attach->dmabuf. Immediate mitigation involves updating the Linux kernel to a version that includes this revert. Previous workarounds only partially solved the problem and are not fully effective, especially for buffer objects without a DRM framebuffer associated.