CVE-2025-38511

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38511
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38511.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-38511
Downstream
Related
Published
2025-08-16T10:54:53Z
Modified
2025-10-22T14:03:14.441070Z
Summary
drm/xe/pf: Clear all LMTT pages on alloc
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Clear all LMTT pages on alloc

Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages.

Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap.

While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.

(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b1d20405821812ad70d95eefe58cadc6d50b0917
Fixed
ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b1d20405821812ad70d95eefe58cadc6d50b0917
Fixed
5d21892c2e15b6a27f8bc907693eca7c6b7cc269
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b1d20405821812ad70d95eefe58cadc6d50b0917
Fixed
705a412a367f383430fa34bada387af2e52eb043

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.15.1
v6.15.2
v6.15.3
v6.15.4
v6.15.5
v6.15.6
v6.16-rc1
v6.16-rc2
v6.16-rc3
v6.16-rc4
v6.16-rc5
v6.7
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "166421354858766795276467984611531582116",
            "length": 788.0
        },
        "target": {
            "function": "lmtt_pt_alloc",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-0db88395",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "166421354858766795276467984611531582116",
            "length": 788.0
        },
        "target": {
            "function": "lmtt_pt_alloc",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-0ebf2677",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "232148723934107051883436829304097705553",
            "length": 91.0
        },
        "target": {
            "function": "lmtt_pt_free",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-1e9e1bd1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "285127719075730827153114931780455103755",
            "length": 655.0
        },
        "target": {
            "function": "lmtt_write_pte",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-30c40a7a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705a412a367f383430fa34bada387af2e52eb043",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "34527975081693975344755989989822196624",
            "length": 768.0
        },
        "target": {
            "function": "lmtt_pt_alloc",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-432b13e1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705a412a367f383430fa34bada387af2e52eb043",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "232148723934107051883436829304097705553",
            "length": 91.0
        },
        "target": {
            "function": "lmtt_pt_free",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-92382fca",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705a412a367f383430fa34bada387af2e52eb043",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "264048682537498147562158640364436831202",
                "79107234931525234636502430012187522846",
                "299692166528209665701343258806650617090",
                "145953819796211651532702794860324401501",
                "298138101044763138746021847811807462769",
                "126955439635930423062679219530920323354",
                "115304595624005879319683641641082549168",
                "112985238945175945043830949739050702635",
                "21629265636109664129797517381470194966",
                "334602112315243762201427299232695058950",
                "119359063649654413233724772268428031624",
                "70118769113810623433954258191833902130",
                "321675126048491722475588303428787189999",
                "212304127907348511201763547863611556346",
                "284611375372885920351162758896018368107"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-93dd89e0",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@705a412a367f383430fa34bada387af2e52eb043",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "264048682537498147562158640364436831202",
                "79107234931525234636502430012187522846",
                "299692166528209665701343258806650617090",
                "145953819796211651532702794860324401501",
                "298138101044763138746021847811807462769",
                "126955439635930423062679219530920323354",
                "115304595624005879319683641641082549168",
                "112985238945175945043830949739050702635",
                "21629265636109664129797517381470194966",
                "334602112315243762201427299232695058950",
                "119359063649654413233724772268428031624",
                "70118769113810623433954258191833902130",
                "321675126048491722475588303428787189999",
                "212304127907348511201763547863611556346",
                "284611375372885920351162758896018368107"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-ad6e2ec7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "232148723934107051883436829304097705553",
            "length": 91.0
        },
        "target": {
            "function": "lmtt_pt_free",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-aef20c68",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "264048682537498147562158640364436831202",
                "79107234931525234636502430012187522846",
                "299692166528209665701343258806650617090",
                "145953819796211651532702794860324401501",
                "298138101044763138746021847811807462769",
                "126955439635930423062679219530920323354",
                "115304595624005879319683641641082549168",
                "112985238945175945043830949739050702635",
                "21629265636109664129797517381470194966",
                "334602112315243762201427299232695058950",
                "119359063649654413233724772268428031624",
                "70118769113810623433954258191833902130",
                "321675126048491722475588303428787189999",
                "212304127907348511201763547863611556346",
                "284611375372885920351162758896018368107"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-d72f8f7b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "285127719075730827153114931780455103755",
            "length": 655.0
        },
        "target": {
            "function": "lmtt_write_pte",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-d8746bc4",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "285127719075730827153114931780455103755",
            "length": 655.0
        },
        "target": {
            "function": "lmtt_write_pte",
            "file": "drivers/gpu/drm/xe/xe_lmtt.c"
        },
        "id": "CVE-2025-38511-da600a1e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
        "signature_type": "Function"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.12.39
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.7