CVE-2025-38703

{"id": "CVE-2025-38703", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "b17fcce70733c211cb5dabf54f4f9491920b1d92", "versionType": "git"}, {"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "ba37807d08bae67de6139346a85650cab5f6145a", "versionType": "git"}, {"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "683b0e397dad9f26a42dcacf6f7f545a77ce6c06", "versionType": "git"}, {"status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "6bd90e700b4285e6a7541e00f969cab0d696adde", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_exec_queue_types.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_fence.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.43", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.11", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.2", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_exec_queue_types.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_fence.c"], "defaultStatus": "affected"}]}], "published": "2025-09-04T16:15:39.130", "references": [{"url": "https://git.kernel.org/stable/c/683b0e397dad9f26a42dcacf6f7f545a77ce6c06", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6bd90e700b4285e6a7541e00f969cab0d696adde", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b17fcce70733c211cb5dabf54f4f9491920b1d92", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ba37807d08bae67de6139346a85650cab5f6145a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Make dma-fences compliant with the safe access rules\n\nXe can free some of the data pointed to by the dma-fences it exports. Most\nnotably the timeline name can get freed if userspace closes the associated\nsubmit queue. At the same time the fence could have been exported to a\nthird party (for example a sync_fence fd) which will then cause an use-\nafter-free on subsequent access.\n\nTo make this safe we need to make the driver compliant with the newly\ndocumented dma-fence rules. Driver has to ensure a RCU grace period\nbetween signalling a fence and freeing any data pointed to by said fence.\n\nFor the timeline name we simply make the queue be freed via kfree_rcu and\nfor the shared lock associated with multiple queues we add a RCU grace\nperiod before freeing the per GT structure holding the lock."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe: Hacer que las dma-fences cumplan con las reglas de acceso seguro\n\nXe puede liberar algunos de los datos a los que apuntan las dma-fences que exporta. En particular, el nombre de la l\u00ednea de tiempo puede ser liberado si el espacio de usuario cierra la cola de env\u00edo asociada. Al mismo tiempo, la fence podr\u00eda haber sido exportada a un tercero (por ejemplo, un fd de sync_fence) lo que luego causar\u00e1 un use-after-free en accesos posteriores.\n\nPara que esto sea seguro, necesitamos hacer que el controlador cumpla con las reglas de dma-fence recientemente documentadas. El controlador debe asegurar un per\u00edodo de gracia RCU entre la se\u00f1alizaci\u00f3n de una fence y la liberaci\u00f3n de cualquier dato al que apunte dicha fence.\n\nPara el nombre de la l\u00ednea de tiempo, simplemente hacemos que la cola sea liberada a trav\u00e9s de kfree_rcu y para el bloqueo compartido asociado con m\u00faltiples colas, a\u00f1adimos un per\u00edodo de gracia RCU antes de liberar la estructura por GT que contiene el bloqueo."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "169986BC-5A8A-4545-BC8B-EDA66328C234", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}