CVE-2025-38511 (GCVE-0-2025-38511)
Vulnerability from cvelistv5
Published
2025-08-16 10:54
Modified
2026-08-05 12:02
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
References
Impacted products
Vendor Product Version
Linux Linux Version: b1d20405821812ad70d95eefe58cadc6d50b0917
Version: b1d20405821812ad70d95eefe58cadc6d50b0917
Version: b1d20405821812ad70d95eefe58cadc6d50b0917
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "705a412a367f383430fa34bada387af2e52eb043",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Clear all LMTT pages on alloc\n\nOur LMEM buffer objects are not cleared by default on alloc\nand during VF provisioning we only setup LMTT PTEs for the\nactually provisioned LMEM range. But beyond that valid range\nwe might leave some stale data that could either point to some\nother VFs allocations or even to the PF pages.\n\nExplicitly clear all new LMTT page to avoid the risk that a\nmalicious VF would try to exploit that gap.\n\nWhile around add asserts to catch any undesired PTE overwrites\nand low-level debug traces to track LMTT PT life-cycle.\n\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing code on a system with an Xe SR-IOV Virtual Function assigned (a guest VM or container), driving GPU accesses to LMEM offsets above the provisioned quota via the VF\u0027s own GGTT/PPGTT entries. No network protocol is involved.\nAC:L - The gap is deterministic and present on every VF provisioning \u2014 no race, no timing window; with tens of thousands of uninitialized dwords and only a 1-bit validity check, thousands of usable rogue mappings are essentially guaranteed, and the VF can additionally groom VRAM with crafted PTE patterns before re-provisioning.\nPR:L - The attacker needs control of a VF (guest-side driver privileges to emit out-of-range LMEM offsets) but holds no privileges whatsoever on the host/PF that owns the vulnerable LMTT; relative to the vulnerable component this is a low, tenant-level authorization.\nUI:N - No victim action is required at exploit time \u2014 the VF simply accesses LMEM beyond its quota. PF-side SR-IOV provisioning is pre-existing administrative setup in any deployment where this code runs.\nS:C - The LMTT is the only hardware mechanism isolating a VF\u0027s local memory from the PF and other VFs, so bypassing it lets a guest reach memory belonging to the host and to other tenants \u2014 the DMA/IOMMU-boundary-bypass case, directly analogous to a guest-to-host escape.\nC:H - Stale valid PTEs map arbitrary 2 MiB-aligned pages across the device\u0027s entire local memory address space (32/128 GiB for 2L, 256 TiB for ML), letting the VF read PF driver allocations and other tenants\u0027 framebuffers and compute data.\nI:H - LMTT PTEs carry no read-only bit, so the VF also writes through the rogue mappings; landing on the LMTT PD/PT pages themselves yields deterministic arbitrary VRAM mapping, and landing on PF/other-VF PPGTT page-table BOs (allocated in VRAM on dGFX) lets the VF redirect another domain\u0027s GPU accesses, including to host system memory.\nA:H - Corrupting PF or peer-VF VRAM \u2014 GPU page tables, GuC context state and firmware images all live in local memory \u2014 causes GPU hangs, engine resets, wedged-device conditions and host driver failure, denying service to the host and every other tenant on the GPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:32.680Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269"
        },
        {
          "url": "https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043"
        }
      ],
      "title": "drm/xe/pf: Clear all LMTT pages on alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38511",
    "datePublished": "2025-08-16T10:54:53.346Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:32.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.