In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Make dma-fences compliant with the safe access rules
Xe can free some of the data pointed to by the dma-fences it exports. Most
notably the timeline name can get freed if userspace closes the associated
submit queue. At the same time the fence could have been exported to a
third party (for example a sync_fence fd) which will then cause an use-
after-free on subsequent access.
To make this safe we need to make the driver compliant with the newly
documented dma-fence rules. Driver has to ensure a RCU grace period
between signalling a fence and freeing any data pointed to by said fence.
For the timeline name we simply make the queue be freed via kfree_rcu and
for the shared lock associated with multiple queues we add a RCU grace
period before freeing the per GT structure holding the lock.
References
Configurations
Configuration 1 (hide)
|
History
24 Nov 2025, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/683b0e397dad9f26a42dcacf6f7f545a77ce6c06 - Patch | |
| References | () https://git.kernel.org/stable/c/6bd90e700b4285e6a7541e00f969cab0d696adde - Patch | |
| References | () https://git.kernel.org/stable/c/b17fcce70733c211cb5dabf54f4f9491920b1d92 - Patch | |
| References | () https://git.kernel.org/stable/c/ba37807d08bae67de6139346a85650cab5f6145a - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Information
Published : 2025-09-04 16:15
Updated : 2025-11-24 19:45
NVD link : CVE-2025-38703
Mitre link : CVE-2025-38703
CVE.ORG link : CVE-2025-38703
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free