CVE-2025-38674
- Source
- https://cve.org/CVERecord?id=CVE-2025-38674
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38674.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38674
- Downstream
BELL (1)
UBUNTU (1)
- Published
- 2025-08-22T16:03:04Z
- Modified
- 2026-08-12T03:51:21Z
- Summary
- Revert "drm/prime: Use dma_buf from GEM object instance"
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Revert "drm/prime: Use dma_buf from GEM object instance"
This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8.
The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref.
Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated.
Hence, this revert to going back to using .import_attach->dmabuf.
v3:
- cc stable
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38674.json" }- References
-
- https://git.kernel.org/stable/c/5f05d83ce689a8930a70dfa73f879604aef8cc03
- https://git.kernel.org/stable/c/fb4ef4a52b79a22ad382bfe77332642d02aef773
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38674.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-38674
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git