CVE-2025-38095 (GCVE-0-2025-38095)

Vulnerability from cvelistv5 – Published: 2025-07-03 07:44 – Updated: 2026-08-05 11:59
VLAI
Title
dma-buf: insert memory barrier before updating num_fences
Summary
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < 90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < d0b7f11dd68b593bd970e5735be00e8d89bace30 (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < 3becc659f9cb76b481ad1fb71f54d5c8d6332d3f (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < c9d2b9a80d06a58f37e0dc8c827075639b443927 (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < fe1bebd0edb22e3536cbc920ec713331d1367ad4 (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < 08680c4dadc6e736c75bc2409d833f03f9003c51 (git)
Affected: a590d0fdbaa56f482ff515e1040b6d9b1b200d63 , < 72c7d62583ebce7baeb61acce6057c361f73be4a (git)
Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.192 , ≤ 5.15.* (semver)
Unaffected: 6.1.140 , ≤ 6.1.* (semver)
Unaffected: 6.6.92 , ≤ 6.6.* (semver)
Unaffected: 6.12.30 , ≤ 6.12.* (semver)
Unaffected: 6.14.8 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:27.686Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "d0b7f11dd68b593bd970e5735be00e8d89bace30",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "3becc659f9cb76b481ad1fb71f54d5c8d6332d3f",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "c9d2b9a80d06a58f37e0dc8c827075639b443927",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "fe1bebd0edb22e3536cbc920ec713331d1367ad4",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "08680c4dadc6e736c75bc2409d833f03f9003c51",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            },
            {
              "lessThan": "72c7d62583ebce7baeb61acce6057c361f73be4a",
              "status": "affected",
              "version": "a590d0fdbaa56f482ff515e1040b6d9b1b200d63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.30",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: insert memory barrier before updating num_fences\n\nsmp_store_mb() inserts memory barrier after storing operation.\nIt is different with what the comment is originally aiming so Null\npointer dereference can be happened if memory update is reordered."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local ioctls on a dma-buf or DRM render-node file descriptor (DMA_BUF_IOCTL_IMPORT_SYNC_FILE / EXPORT_SYNC_FILE / SYNC, and DRM_RENDER_ALLOW submit/wait/busy ioctls). No network or remote peer input reaches dma_resv_add_fence().\nAC:L - The attacker controls both sides of the race \u2014 one thread adds fences via DMA_BUF_IOCTL_IMPORT_SYNC_FILE while another iterates them locklessly via EXPORT_SYNC_FILE/SYNC \u2014 pinning threads to separate CPUs and looping indefinitely, and can groom the slab so the uninitialized slot holds a chosen value. The equivalent race was already demonstrated by the unprivileged igt/gem_busy/close-race testcase producing a GPF with slab poison, and affected weakly-ordered arm64 hardware is mainstream, not a rare configuration.\nPR:L - Only an unprivileged local user is needed: a dma-buf fd from /dev/dma_heap (accessible to every Android app) or a DRM render node (world/render-group accessible on desktops and containers with GPU passthrough), and all the relevant DRM ioctls are marked DRM_RENDER_ALLOW.\nUI:N - The attacker\u0027s own two threads perform both the fence addition and the lockless iteration on its own file descriptors. No victim action of any kind is required.\nS:U - The corruption occurs in kernel memory within the same security authority as the attacking process; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The reader dereferences an uninitialized/stale slab slot as a struct dma_fence *, giving reads at attacker-groomable addresses, and the bogus fence can be wrapped into a sync_file fd whose SYNC_IOC_FILE_INFO returns kernel-memory-derived strings and fields to userspace. Stale slots may also hold already-released fence pointers, a classic use-after-free read.\nI:H - kref_get_unless_zero() on the wild pointer performs an atomic increment at an attacker-influenced kernel address, and the subsequent dma_fence_is_signaled() makes an indirect call through fence-\u003eops-\u003esignaled \u2014 an attacker-controlled function pointer \u2014 providing both a write primitive and control-flow hijack potential.\nA:H - The documented manifestations are a NULL pointer dereference (per the commit message) and a general protection fault from dereferencing garbage heap data (per the Fixes: commit\u0027s oops log), both of which panic or oops the kernel. The race can be re-triggered in a loop for repeated denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:28.799Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0b7f11dd68b593bd970e5735be00e8d89bace30"
        },
        {
          "url": "https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9d2b9a80d06a58f37e0dc8c827075639b443927"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe1bebd0edb22e3536cbc920ec713331d1367ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a"
        }
      ],
      "title": "dma-buf: insert memory barrier before updating num_fences",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38095",
    "datePublished": "2025-07-03T07:44:18.214Z",
    "dateReserved": "2025-04-16T04:51:23.984Z",
    "dateUpdated": "2026-08-05T11:59:28.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38095",
      "date": "2026-08-13",
      "epss": "0.0018",
      "percentile": "0.07708"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-13T01:38:39.000Z",
      "cve": "CVE-2025-38095",
      "id": "msrc_CVE-2025-38095",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dma-buf: insert memory barrier before updating num_fences",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38095.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38095\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T08:15:26.300\",\"lastModified\":\"2026-07-30T06:22:50.430\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndma-buf: insert memory barrier before updating num_fences\\n\\nsmp_store_mb() inserts memory barrier after storing operation.\\nIt is different with what the comment is originally aiming so Null\\npointer dereference can be happened if memory update is reordered.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dma-buf: inserta una barrera de memoria antes de actualizar num_fences. smp_store_mb() inserta una barrera de memoria despu\u00e9s de la operaci\u00f3n de almacenamiento. Esto difiere del objetivo original del comentario, por lo que puede producirse una desreferencia de puntero nulo si se reordena la actualizaci\u00f3n de memoria.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma-buf/dma-resv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"d0b7f11dd68b593bd970e5735be00e8d89bace30\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"3becc659f9cb76b481ad1fb71f54d5c8d6332d3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"c9d2b9a80d06a58f37e0dc8c827075639b443927\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"fe1bebd0edb22e3536cbc920ec713331d1367ad4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"08680c4dadc6e736c75bc2409d833f03f9003c51\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a590d0fdbaa56f482ff515e1040b6d9b1b200d63\",\"lessThan\":\"72c7d62583ebce7baeb61acce6057c361f73be4a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma-buf/dma-resv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.192\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.140\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.92\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.30\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.8\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"1305E469-C65A-4E94-B785-0332F02FE163\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.192\",\"matchCriteriaId\":\"8A911BD7-361F-45C0-A4A6-33FCBA0F6117\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.140\",\"matchCriteriaId\":\"EEA541CD-1863-4E7F-85F5-EAC305910323\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.92\",\"matchCriteriaId\":\"7787FD66-D748-44AF-A052-DE495E1E23AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.30\",\"matchCriteriaId\":\"8F43EF2E-9448-4BCA-99D9-DAEAEB7523C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.8\",\"matchCriteriaId\":\"D4458049-AD51-4F1B-BAB9-C32B53A54DE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9d2b9a80d06a58f37e0dc8c827075639b443927\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0b7f11dd68b593bd970e5735be00e8d89bace30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe1bebd0edb22e3536cbc920ec713331d1367ad4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:23:37+00:00",
      "cve": "CVE-2025-38095",
      "id": "CVE-2025-38095",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel dma-buf: Denial of Service via memory reordering",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38095.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:51:39Z",
      "cve": "CVE-2025-38095",
      "id": "CVE-2025-38095",
      "initial_release_date": "2025-07-03T23:24:06Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "572",
      "product_status:known_not_affected": "145",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38095",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38095.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.