CVE-2025-38389

{
  "id": "CVE-2025-38389",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "60b757730884e4a223152a68d9b5f625dac94119",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "e47d7d6edc40a6ace7cc04e5893759fee68569f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "f10af34261448610d4048ac6e6af87f80e3881a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "4c778c96e469fb719b11683e0a3be8ea68052fa2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "40e09506aea1fde1f3e0e04eca531bbb23404baf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "5a7ae7bebdc4c2ecd48a2c061319956f65c09473",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "c542d62883f62ececafcb630a1c5010133826bea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75d0a7f31eec8ec4a53b4485905800e09dc5091f",
              "lessThan": "a5aa7bc1fca78c7fa127d9e33aa94a0c9066c1d6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_ring_submission.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_ring_submission.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-07-25T13:15:28.240",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/40e09506aea1fde1f3e0e04eca531bbb23404baf",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4c778c96e469fb719b11683e0a3be8ea68052fa2",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a7ae7bebdc4c2ecd48a2c061319956f65c09473",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60b757730884e4a223152a68d9b5f625dac94119",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a5aa7bc1fca78c7fa127d9e33aa94a0c9066c1d6",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c542d62883f62ececafcb630a1c5010133826bea",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e47d7d6edc40a6ace7cc04e5893759fee68569f5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f10af34261448610d4048ac6e6af87f80e3881a4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix timeline left held on VMA alloc error\n\nThe following error has been reported sporadically by CI when a test\nunbinds the i915 driver on a ring submission platform:\n\n<4> [239.330153] ------------[ cut here ]------------\n<4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count)\n<4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n<4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n<4> [239.330942] Call Trace:\n<4> [239.330944]  <TASK>\n<4> [239.330949]  i915_driver_late_release+0x2b/0xa0 [i915]\n<4> [239.331202]  i915_driver_release+0x86/0xa0 [i915]\n<4> [239.331482]  devm_drm_dev_init_release+0x61/0x90\n<4> [239.331494]  devm_action_release+0x15/0x30\n<4> [239.331504]  release_nodes+0x3d/0x120\n<4> [239.331517]  devres_release_all+0x96/0xd0\n<4> [239.331533]  device_unbind_cleanup+0x12/0x80\n<4> [239.331543]  device_release_driver_internal+0x23a/0x280\n<4> [239.331550]  ? bus_find_device+0xa5/0xe0\n<4> [239.331563]  device_driver_detach+0x14/0x20\n...\n<4> [357.719679] ---[ end trace 0000000000000000 ]---\n\nIf the test also unloads the i915 module then that's followed with:\n\n<3> [357.787478] =============================================================================\n<3> [357.788006] BUG i915_vma (Tainted: G     U  W        N ): Objects remaining on __kmem_cache_shutdown()\n<3> [357.788031] -----------------------------------------------------------------------------\n<3> [357.788204] Object 0xffff888109e7f480 @offset=29824\n<3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244\n<4> [357.788994]  i915_vma_instance+0xee/0xc10 [i915]\n<4> [357.789290]  init_status_page+0x7b/0x420 [i915]\n<4> [357.789532]  intel_engines_init+0x1d8/0x980 [i915]\n<4> [357.789772]  intel_gt_init+0x175/0x450 [i915]\n<4> [357.790014]  i915_gem_init+0x113/0x340 [i915]\n<4> [357.790281]  i915_driver_probe+0x847/0xed0 [i915]\n<4> [357.790504]  i915_pci_probe+0xe6/0x220 [i915]\n...\n\nCloser analysis of CI results history has revealed a dependency of the\nerror on a few IGT tests, namely:\n- igt@api_intel_allocator@fork-simple-stress-signal,\n- igt@api_intel_allocator@two-level-inception-interruptible,\n- igt@gem_linear_blits@interruptible,\n- igt@prime_mmap_coherency@ioctl-errors,\nwhich invisibly trigger the issue, then exhibited with first driver unbind\nattempt.\n\nAll of the above tests perform actions which are actively interrupted with\nsignals.  Further debugging has allowed to narrow that scope down to\nDRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring\nsubmission, in particular.\n\nIf successful then that function, or its execlists or GuC submission\nequivalent, is supposed to be called only once per GEM context engine,\nfollowed by raise of a flag that prevents the function from being called\nagain.  The function is expected to unwind its internal errors itself, so\nit may be safely called once more after it returns an error.\n\nIn case of ring submission, the function first gets a reference to the\nengine's legacy timeline and then allocates a VMA.  If the VMA allocation\nfails, e.g. when i915_vma_instance() called from inside is interrupted\nwith a signal, then ring_context_alloc() fails, leaving the timeline held\nreferenced.  On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the\ntimeline is got, and only that last one is put on successful completion.\nAs a consequence, the legacy timeline, with its underlying engine status\npage's VMA object, is still held and not released on driver unbind.\n\nGet the legacy timeline only after successful allocation of the context\nengine's VMA.\n\nv2: Add a note on other submission methods (Krzysztof Karas):\n    Both execlists and GuC submission use lrc_alloc() which seems free\n    from a similar issue.\n\n(cherry picked from commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f)"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/i915/gt: Se corrige el error de línea de tiempo retenida en la asignación de VMA. CI ha informado esporádicamente del siguiente error cuando una prueba desvincula el controlador i915 en una plataforma de envío de anillo: &lt;4&gt; [239.330153] ------------[ cut here ]------------ &lt;4&gt; [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv-&gt;mm.shrink_count) &lt;4&gt; [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... &lt;4&gt; [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... &lt;4&gt; [239.330942] Call Trace: &lt;4&gt; [239.330944]  &lt;4&gt; [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] &lt;4&gt; [239.331202] i915_driver_release+0x86/0xa0 [i915] &lt;4&gt; [239.331482] devm_drm_dev_init_release+0x61/0x90 &lt;4&gt; [239.331494] devm_action_release+0x15/0x30 &lt;4&gt; [239.331504] release_nodes+0x3d/0x120 &lt;4&gt; [239.331517] devres_release_all+0x96/0xd0 &lt;4&gt; [239.331533] device_unbind_cleanup+0x12/0x80 &lt;4&gt; [239.331543] device_release_driver_internal+0x23a/0x280 &lt;4&gt; [239.331550] ? bus_find_device+0xa5/0xe0 &lt;4&gt; [239.331563] device_driver_detach+0x14/0x20 ... &lt;4&gt; [357.719679] ---[ end trace 0000000000000000 ]--- If the test also unloads the i915 module then that's followed with: &lt;3&gt; [357.787478] ============================================================================= &lt;3&gt; [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() &lt;3&gt; [357.788031] ----------------------------------------------------------------------------- &lt;3&gt; [357.788204] Object 0xffff888109e7f480 @offset=29824 &lt;3&gt; [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 &lt;4&gt; [357.788994] i915_vma_instance+0xee/0xc10 [i915] &lt;4&gt; [357.789290] init_status_page+0x7b/0x420 [i915] &lt;4&gt; [357.789532] intel_engines_init+0x1d8/0x980 [i915] &lt;4&gt; [357.789772] intel_gt_init+0x175/0x450 [i915] &lt;4&gt;  ---truncado--- Un análisis más detallado del historial de resultados de CI ha revelado una dependencia del error en algunas pruebas IGT, a saber: - igt@api_intel_allocator@fork-simple-stress-signal, - igt@api_intel_allocator@two-level-inception-interruptible, - igt@gem_linear_blits@interruptible, - igt@prime_mmap_coherency@ioctl-errors, que activan el problema de forma invisible y se muestran con el primer intento de desvinculación del controlador. Todas las pruebas anteriores realizan acciones que se interrumpen activamente con señales. Una depuración posterior ha permitido limitar este alcance a DRM_IOCTL_I915_GEM_EXECBUFFER2 y ring_context_alloc(), específicos para el envío de anillos. Si la ejecución es correcta, se supone que esa función, o sus execlists o equivalentes de envío de GuC, se llamará solo una vez por motor de contexto GEM, seguido de la activación de un indicador que impide que se vuelva a llamar. Se espera que la función corrija sus errores internos por sí misma, por lo que puede volver a llamarse de forma segura después de devolver un error. En caso de envío de anillo, la función primero obtiene una referencia a la línea de tiempo heredada del motor y luego asigna un VMA. Si la asignación del VMA falla, por ejemplo, cuando i915_vma_instance() llamado desde dentro se interrumpe con una señal, entonces ring_context_alloc() falla, dejando la línea de tiempo referenciada. En la siguiente IOCTL I915_GEM_EXECBUFFER2, se obtiene otra referencia a la línea de tiempo, y solo esta última se coloca al completarse correctamente. Como consecuencia, la línea de tiempo heredada, con el objeto VMA de su página de estado del motor subyacente, aún se mantiene y no se libera al desvincular el controlador. Obtenga la línea de tiempo heredada solo después de la asignación exitosa del VMA del motor de contexto. v2: Agregar una nota sobre otros métodos de envío (Krzysztof Karas): Tanto los execlists como el envío GuC usan lrc_alloc(), que parec"
    }
  ],
  "lastModified": "2026-06-17T09:16:45.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02FB3A90-2158-480C-8BBA-030211E19AD9",
              "versionEndExcluding": "5.4.296",
              "versionStartIncluding": "5.4"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E73A49A-F9B2-470F-91B2-6FAB6239BDB6",
              "versionEndExcluding": "5.10.240",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BD28D29-423C-4173-9DB8-3BA14E9F665D",
              "versionEndExcluding": "5.15.187",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81CF08DB-B7A2-4556-8AE3-ED9144F50E31",
              "versionEndExcluding": "6.1.144",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB1BB991-B903-4718-966C-07C803CBEABC",
              "versionEndExcluding": "6.6.97",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D",
              "versionEndExcluding": "6.12.37",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
              "versionEndExcluding": "6.15.6",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}