CVE-2025-38095 (GCVE-0-2025-38095)
Vulnerability from cvelistv5
Published
2025-07-03 07:44
Modified
2026-08-05 11:59
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
References
Impacted products
Vendor Product Version
Linux Linux Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
Version: a590d0fdbaa56f482ff515e1040b6d9b1b200d63
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:27.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "d0b7f11dd68b593bd970e5735be00e8d89bace30",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "3becc659f9cb76b481ad1fb71f54d5c8d6332d3f",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "c9d2b9a80d06a58f37e0dc8c827075639b443927",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "fe1bebd0edb22e3536cbc920ec713331d1367ad4",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "08680c4dadc6e736c75bc2409d833f03f9003c51",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "72c7d62583ebce7baeb61acce6057c361f73be4a",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.30",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: insert memory barrier before updating num_fences\n\nsmp_store_mb() inserts memory barrier after storing operation.\nIt is different with what the comment is originally aiming so Null\npointer dereference can be happened if memory update is reordered."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local ioctls on a dma-buf or DRM render-node file descriptor (DMA_BUF_IOCTL_IMPORT_SYNC_FILE / EXPORT_SYNC_FILE / SYNC, and DRM_RENDER_ALLOW submit/wait/busy ioctls). No network or remote peer input reaches dma_resv_add_fence().\nAC:L - The attacker controls both sides of the race \u2014 one thread adds fences via DMA_BUF_IOCTL_IMPORT_SYNC_FILE while another iterates them locklessly via EXPORT_SYNC_FILE/SYNC \u2014 pinning threads to separate CPUs and looping indefinitely, and can groom the slab so the uninitialized slot holds a chosen value. The equivalent race was already demonstrated by the unprivileged igt/gem_busy/close-race testcase producing a GPF with slab poison, and affected weakly-ordered arm64 hardware is mainstream, not a rare configuration.\nPR:L - Only an unprivileged local user is needed: a dma-buf fd from /dev/dma_heap (accessible to every Android app) or a DRM render node (world/render-group accessible on desktops and containers with GPU passthrough), and all the relevant DRM ioctls are marked DRM_RENDER_ALLOW.\nUI:N - The attacker\u0027s own two threads perform both the fence addition and the lockless iteration on its own file descriptors. No victim action of any kind is required.\nS:U - The corruption occurs in kernel memory within the same security authority as the attacking process; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The reader dereferences an uninitialized/stale slab slot as a struct dma_fence *, giving reads at attacker-groomable addresses, and the bogus fence can be wrapped into a sync_file fd whose SYNC_IOC_FILE_INFO returns kernel-memory-derived strings and fields to userspace. Stale slots may also hold already-released fence pointers, a classic use-after-free read.\nI:H - kref_get_unless_zero() on the wild pointer performs an atomic increment at an attacker-influenced kernel address, and the subsequent dma_fence_is_signaled() makes an indirect call through fence-\u003eops-\u003esignaled \u2014 an attacker-controlled function pointer \u2014 providing both a write primitive and control-flow hijack potential.\nA:H - The documented manifestations are a NULL pointer dereference (per the commit message) and a general protection fault from dereferencing garbage heap data (per the Fixes: commit\u0027s oops log), both of which panic or oops the kernel. The race can be re-triggered in a loop for repeated denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:28.799Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0b7f11dd68b593bd970e5735be00e8d89bace30"
        },
        {
          "url": "https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9d2b9a80d06a58f37e0dc8c827075639b443927"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe1bebd0edb22e3536cbc920ec713331d1367ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a"
        }
      ],
      "title": "dma-buf: insert memory barrier before updating num_fences",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38095",
    "datePublished": "2025-07-03T07:44:18.214Z",
    "dateReserved": "2025-04-16T04:51:23.984Z",
    "dateUpdated": "2026-08-05T11:59:28.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.