n the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock.
Configuration 1 (hide)
|
24 Nov 2025, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-416 | |
| References | () https://git.kernel.org/stable/c/683b0e397dad9f26a42dcacf6f7f545a77ce6c06 - Patch | |
| References | () https://git.kernel.org/stable/c/6bd90e700b4285e6a7541e00f969cab0d696adde - Patch | |
| References | () https://git.kernel.org/stable/c/b17fcce70733c211cb5dabf54f4f9491920b1d92 - Patch | |
| References | () https://git.kernel.org/stable/c/ba37807d08bae67de6139346a85650cab5f6145a - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
05 Sep 2025, 17:47
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-09-04 16:15
Updated : 2025-11-24 19:45
NVD link : CVE-2025-38703
Mitre link : CVE-2025-38703
CVE.ORG link : CVE-2025-38703
JSON object : View
Use After Free