CVE-2025-38722 (GCVE-0-2025-38722)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:33 – Updated: 2026-08-05 12:04
VLAI
Title
habanalabs: fix UAF in export_dmabuf()
Summary
In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). habanalabs export_dmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been". Fix that by reserving descriptor before anything else and do fd_install() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet; unlike dma_buf_fd(), fd_install() can't fail.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < c07886761fd6251db6938d4e747002e3d150d231 (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 40deceb38f9db759772d1c289c28fd2a543f57fc (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 55c232d7e0241f1d5120b595e7a9de24c75ed3d8 (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 33927f3d0ecdcff06326d6e4edb6166aed42811c (git)
Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c07886761fd6251db6938d4e747002e3d150d231",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close.  In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of -\u003erelease() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up.  As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can\u0027t fail."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM_IOCTL_HL_MEMORY ioctl (HL_MEM_OP_EXPORT_DMABUF_FD) on the local /dev/accel/accelN character device, requiring local system access. No network or physical vector is involved.\nAC:L - The attacker owns both sides of the race \u2014 one thread issues the export ioctl while a sibling thread spins on close() of the deterministically-numbered fd in the same process\u0027s fd table \u2014 and the ioctl can be retried indefinitely until the window is won. No condition depends on external state the attacker cannot influence.\nPR:L - The ioctl is registered with flags 0, so drm_ioctl_permit(), accel_open(), hl_device_open() and hl_mem_ioctl() perform no capability, root, or DRM-auth check; only an open fd on the accel node is required, which unprivileged compute users and containerized AI workloads normally have.\nUI:N - The attacking process triggers the race entirely on its own with two of its own threads. No victim action, mount, or file open is needed.\nS:U - The premature reference drops corrupt kernel objects (struct hl_ctx, struct file) within the same kernel security authority. No IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The use-after-free lets the attacker reclaim the freed hl_ctx/struct file slab objects with controlled content and have the kernel dereference them (ctx-\u003ehdev, ctx-\u003ehpriv-\u003efile_priv-\u003efilp), and the premature fput() on the accel device file yields a DirtyCred-style file UAF enabling arbitrary kernel memory disclosure.\nI:H - The exporting thread performs atomic refcount increments (hl_ctx_get, atomic_inc, get_file) through pointers read out of freed, attacker-reclaimable memory, giving a write primitive at an influenceable address; a dangling struct file reference is a well-established path to control-flow hijack and privilege escalation.\nA:H - Losing the race yields a NULL pointer dereference in memhash_node_export_put() (ctx is still NULL) or refcount underflow and use-after-free on the context and device file, causing an immediate kernel oops/panic that any local user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:17.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"
        },
        {
          "url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"
        }
      ],
      "title": "habanalabs: fix UAF in export_dmabuf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38722",
    "datePublished": "2025-09-04T15:33:15.641Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:17.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38722",
      "date": "2026-08-07",
      "epss": "0.00153",
      "percentile": "0.04921"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-12T14:46:03.000Z",
      "cve": "CVE-2025-38722",
      "id": "msrc_CVE-2025-38722",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:known_affected": "17",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "habanalabs: fix UAF in export_dmabuf()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38722.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38722\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-04T16:15:41.993\",\"lastModified\":\"2026-07-30T06:23:37.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhabanalabs: fix UAF in export_dmabuf()\\n\\nAs soon as we\u0027d inserted a file reference into descriptor table, another\\nthread could close it.  That\u0027s fine for the case when all we are doing is\\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\\nrace and there\u0027s nothing the kernel can do about it).  However, if we\\nfollow fd_install() with any kind of access to objects that would be\\ndestroyed on close (be it the struct file itself or anything destroyed\\nby its -\u003erelease()), we have a UAF.\\n\\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\\nhabanalabs export_dmabuf() calls it and then proceeds to access the\\nobjects destroyed on close.  In particular, it grabs an extra reference to\\nanother struct file that will be dropped as part of -\u003erelease() for ours;\\nthat \\\"will be\\\" is actually \\\"might have already been\\\".\\n\\nFix that by reserving descriptor before anything else and do fd_install()\\nonly when everything had been set up.  As a side benefit, we no longer\\nhave the failure exit with file already created, but reference to\\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\\nunlike dma_buf_fd(), fd_install() can\u0027t fail.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/accel/habanalabs/common/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"db1a8dd916aac986871f6b873a3aefad906f383a\",\"lessThan\":\"c07886761fd6251db6938d4e747002e3d150d231\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db1a8dd916aac986871f6b873a3aefad906f383a\",\"lessThan\":\"40deceb38f9db759772d1c289c28fd2a543f57fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db1a8dd916aac986871f6b873a3aefad906f383a\",\"lessThan\":\"55c232d7e0241f1d5120b595e7a9de24c75ed3d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db1a8dd916aac986871f6b873a3aefad906f383a\",\"lessThan\":\"33927f3d0ecdcff06326d6e4edb6166aed42811c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/accel/habanalabs/common/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"37BFE2B2-793C-4855-98A2-693DB8914D33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:13:56+00:00",
      "cve": "CVE-2025-38722",
      "id": "CVE-2025-38722",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: habanalabs: fix UAF in export_dmabuf()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38722.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T06:04:50Z",
      "cve": "CVE-2025-38722",
      "id": "CVE-2025-38722",
      "initial_release_date": "2025-09-04T23:23:18Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "451",
      "product_status:known_not_affected": "203",
      "product_status:recommended": "481",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38722",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38722.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.