CVE-2025-38722

HIGH EPSS 3.9%
Published Sep 4, 20259mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Sep 4, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). habanalabs export_dmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been". Fix that by reserving descriptor before anything else and do fd_install() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet; unlike dma_buf_fd(), fd_install() can't fail.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥5.16  –  <6.12.43
linuxlinux_kernel*≥6.13  –  <6.15.11
linuxlinux_kernel*≥6.16  –  <6.16.2
linuxlinux_kernel6.17any

References 4

  • git.kernel.org https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231
    Patch