CVE-2025-38595 (GCVE-0-2025-38595)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
xen: fix UAF in dmabuf_exp_from_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a240d6e42e28c34fdc34b3a98ca838a31c939901 , < e5907885260401bba300d4d18d79875c05b82651 (git)
Affected: a240d6e42e28c34fdc34b3a98ca838a31c939901 , < 3edfd2353f301bfffd5ee41066e37320a59ccc2d (git)
Affected: a240d6e42e28c34fdc34b3a98ca838a31c939901 , < d59d49af4aeed9a81e673e37c26c6a3bacf1a181 (git)
Affected: a240d6e42e28c34fdc34b3a98ca838a31c939901 , < 532c8b51b3a8676cbf533a291f8156774f30ea87 (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev-dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e5907885260401bba300d4d18d79875c05b82651",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "3edfd2353f301bfffd5ee41066e37320a59ccc2d",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "d59d49af4aeed9a81e673e37c26c6a3bacf1a181",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "532c8b51b3a8676cbf533a291f8156774f30ea87",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev-dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: fix UAF in dmabuf_exp_from_pages()\n\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\nup to xen folks]\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\nobjects destroyed on close - starting with gntdev_dmabuf itself.\n\nFix that by doing reserving descriptor before anything else and do\nfd_install() only when everything had been set up."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through `IOCTL_GNTDEV_DMABUF_EXP_FROM_REFS` on the local `/dev/xen/gntdev` misc device, requiring local access to the machine (dom0 or a HVM/PVH guest). No network-facing path reaches `dmabuf_exp_from_pages()`.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues the export ioctl while another closes the freshly installed fd, whose number is deterministic (lowest free descriptor) \u2014 and the window spans a sleepable `mutex_lock()`, making it wide; the ioctl can be retried indefinitely until it wins.\nPR:L - `gntdev_ioctl()` contains no `capable()` or `CAP_*` checks at all, so any user able to open `/dev/xen/gntdev` can trigger it; Xen stacks that use this exact dma-buf path (automotive display virtualization, Qubes vchan) grant unprivileged users access to that node.\nUI:N - Exploitation is entirely self-contained within the attacker\u0027s own multi-threaded process issuing an ioctl and a concurrent `close()`; no victim action is required.\nS:U - The freed objects (`struct gntdev_dmabuf`, the gntdev `struct file`) and the resulting corruption all live in the same kernel\u0027s memory as the attacker\u0027s own domain; nothing crosses the hypervisor or IOMMU boundary.\nC:H - `get_file(gntdev_dmabuf-\u003epriv-\u003efilp)` reads a pointer out of freed, attacker-groomable `kmalloc-96` memory, and `list_add()` writes kernel heap pointers into that freed slot which can be read back via a resprayed object, yielding kernel memory disclosure; the resulting `struct file` UAF permits arbitrary kernel read.\nI:H - The unmatched `fput()` on `priv-\u003efilp` underflows the gntdev file refcount and frees a `struct file` still referenced by an open fd, and the code writes into the freed `gntdev_dmabuf` (`-\u003efd = ret`, `list_add`) \u2014 a classic UAF/DirtyCred-style write primitive leading to control-flow hijack and privilege escalation.\nA:H - Losing the race before `list_add()` makes `dmabuf_exp_release()` run `list_del()` on a zeroed `list_head`, causing a NULL-pointer write oops (or a corruption WARN plus heap/list corruption), and the general UAF and file refcount underflow readily panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:17.183Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651"
        },
        {
          "url": "https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181"
        },
        {
          "url": "https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87"
        }
      ],
      "title": "xen: fix UAF in dmabuf_exp_from_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38595",
    "datePublished": "2025-08-19T17:03:25.527Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:17.183Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38595",
      "date": "2026-08-07",
      "epss": "0.00176",
      "percentile": "0.07256"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38595\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:37.343\",\"lastModified\":\"2026-07-30T06:23:29.503\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen: fix UAF in dmabuf_exp_from_pages()\\n\\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\\nup to xen folks]\\n\\nAs soon as we\u0027d inserted a file reference into descriptor table, another\\nthread could close it.  That\u0027s fine for the case when all we are doing is\\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\\nrace and there\u0027s nothing the kernel can do about it).  However, if we\\nfollow fd_install() with any kind of access to objects that would be\\ndestroyed on close (be it the struct file itself or anything destroyed\\nby its -\u003erelease()), we have a UAF.\\n\\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\\nobjects destroyed on close - starting with gntdev_dmabuf itself.\\n\\nFix that by doing reserving descriptor before anything else and do\\nfd_install() only when everything had been set up.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen: correcci\u00f3n de UAF en dmabuf_exp_from_pages() [dma_buf_fd() corrige; no hay preferencias sobre el \u00e1rbol que recorre - depende de los usuarios de xen]. En cuanto insertamos una referencia a un archivo en la tabla de descriptores, otro hilo podr\u00eda cerrarla. Esto funciona bien cuando solo devolvemos ese descriptor al espacio de usuario (es una ejecuci\u00f3n, pero es una ejecuci\u00f3n de espacio de usuario y el kernel no puede hacer nada al respecto). Sin embargo, si despu\u00e9s de fd_install() accedemos a objetos que se destruir\u00edan al cerrar (ya sea el propio archivo de estructura o cualquier objeto destruido por su -\u0026gt;release()), tenemos un UAF. dma_buf_fd() combina la reserva de un descriptor con fd_install(). gntdev dmabuf_exp_from_pages() lo llama y procede a acceder a los objetos destruidos al cerrar, empezando por el propio gntdev_dmabuf. Arregle esto reservando el descriptor antes de cualquier otra cosa y ejecutando fd_install() solo cuando todo est\u00e9 configurado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/xen/gntdev-dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a240d6e42e28c34fdc34b3a98ca838a31c939901\",\"lessThan\":\"e5907885260401bba300d4d18d79875c05b82651\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a240d6e42e28c34fdc34b3a98ca838a31c939901\",\"lessThan\":\"3edfd2353f301bfffd5ee41066e37320a59ccc2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a240d6e42e28c34fdc34b3a98ca838a31c939901\",\"lessThan\":\"d59d49af4aeed9a81e673e37c26c6a3bacf1a181\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a240d6e42e28c34fdc34b3a98ca838a31c939901\",\"lessThan\":\"532c8b51b3a8676cbf533a291f8156774f30ea87\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/xen/gntdev-dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.42\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.10\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"6.12.42\",\"matchCriteriaId\":\"D1041F7F-DC8F-400D-8487-F9D5516F5661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.10\",\"matchCriteriaId\":\"5890C690-B295-40C2-9121-FF5F987E5142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.1\",\"matchCriteriaId\":\"58182352-D7DF-4CC9-841E-03C1D852C3FB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:33:32+00:00",
      "cve": "CVE-2025-38595",
      "id": "CVE-2025-38595",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xen: fix UAF in dmabuf_exp_from_pages()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38595.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:43:57Z",
      "cve": "CVE-2025-38595",
      "id": "CVE-2025-38595",
      "initial_release_date": "2025-08-19T23:23:13Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "572",
      "product_status:known_not_affected": "102",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38595",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38595.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.