CVE-2025-38703
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-04

Last updated on: 2025-11-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-04
Last Modified
2025-11-24
Generated
2026-05-07
AI Q&A
2025-09-04
EPSS Evaluated
2026-05-05
NVD
CVE-2025-38703
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's drm/xe driver involves improper handling of dma-fences, which are synchronization primitives. The driver can free data pointed to by dma-fences, such as the timeline name, when userspace closes the associated submit queue. However, if the fence has been exported to a third party (e.g., via a sync_fence file descriptor), subsequent access can cause a use-after-free error. The fix involves making the driver compliant with dma-fence safe access rules by ensuring a Read-Copy-Update (RCU) grace period between signaling a fence and freeing any data it points to, preventing use-after-free conditions.


How can this vulnerability impact me? :

This vulnerability can lead to use-after-free errors in the Linux kernel's drm/xe driver, which may cause system instability, crashes, or potential security issues such as privilege escalation or arbitrary code execution if exploited. It affects the safe handling of synchronization objects shared between kernel and userspace, potentially impacting system reliability and security.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, update your Linux kernel to a version where the drm/xe driver has been fixed to comply with the safe dma-fence access rules. This includes ensuring the driver uses RCU grace periods before freeing data pointed to by dma-fences. Applying the latest kernel patches or updates from your Linux distribution that address this issue is recommended.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart