CVE-2025-38722

{"id": "CVE-2025-38722", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "5b0c23e9ec3e161a893d6ff9b4fad479e4539627", "versionType": "git"}, {"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "d26058c2349d77d1ef179a2cc9752ca12004b6ff", "versionType": "git"}, {"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "c07886761fd6251db6938d4e747002e3d150d231", "versionType": "git"}, {"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc", "versionType": "git"}, {"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8", "versionType": "git"}, {"status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c", "versionType": "git"}], "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.43", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.11", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.2", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "defaultStatus": "affected"}]}], "published": "2025-09-04T16:15:41.993", "references": [{"url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it. That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it). However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its ->release()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close. In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of ->release() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up. As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can't fail."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhabanalabs: corrige UAF en export_dmabuf()\n\nTan pronto como hubi\u00e9ramos insertado una referencia de archivo en la tabla de descriptores, otro hilo podr\u00eda cerrarla. Eso est\u00e1 bien para el caso en que todo lo que estamos haciendo es devolver ese descriptor al espacio de usuario (es una condici\u00f3n de carrera, pero es una condici\u00f3n de carrera del espacio de usuario y no hay nada que el kernel pueda hacer al respecto). Sin embargo, si despu\u00e9s de fd_install() seguimos con cualquier tipo de acceso a objetos que ser\u00edan destruidos al cerrar (ya sea la propia struct file o cualquier cosa destruida por su ->release()), tenemos un UAF.\n\ndma_buf_fd() es una combinaci\u00f3n de reservar un descriptor y fd_install(). habanalabs export_dmabuf() lo llama y luego procede a acceder a los objetos destruidos al cerrar. En particular, toma una referencia adicional a otra struct file que ser\u00e1 liberada como parte de ->release() para la nuestra; ese 'ser\u00e1' es en realidad 'podr\u00eda haber sido ya'.\n\nCorregir eso reservando el descriptor antes que nada y haciendo fd_install() solo cuando todo hubiera sido configurado. Como beneficio adicional, ya no tenemos la salida por fallo con el archivo ya creado, pero la referencia al archivo subyacente (as\u00ed como ->dmabuf_export_cnt, etc.) a\u00fan no tomada; a diferencia de dma_buf_fd(), fd_install() no puede fallar."}], "lastModified": "2026-10-30T13:18:07.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37BFE2B2-793C-4855-98A2-693DB8914D33", "versionEndExcluding": "6.12.43", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}