CVE-2025-38722

As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF.

dmabuffd() is a combination of reserving a descriptor and fdinstall(). habanalabs exportdmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been".

Fix that by reserving descriptor before anything else and do fdinstall() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabufexportcnt, etc.) not grabbed yet; unlike dmabuffd(), fdinstall() can't fail.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

db1a8dd916aac986871f6b873a3aefad906f383a

Fixed

c07886761fd6251db6938d4e747002e3d150d231

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

db1a8dd916aac986871f6b873a3aefad906f383a

Fixed

40deceb38f9db759772d1c289c28fd2a543f57fc

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

db1a8dd916aac986871f6b873a3aefad906f383a

Fixed

55c232d7e0241f1d5120b595e7a9de24c75ed3d8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

db1a8dd916aac986871f6b873a3aefad906f383a

Fixed

33927f3d0ecdcff06326d6e4edb6166aed42811c

Affected versions

v5.*

v5.15

v5.15-rc7

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.15

v6.12.16

v6.12.17

v6.12.18

v6.12.19

v6.12.2

v6.12.20

v6.12.21

v6.12.22

v6.12.23

v6.12.24

v6.12.25

v6.12.26

v6.12.27

v6.12.28

v6.12.29

v6.12.3

v6.12.30

v6.12.31

v6.12.32

v6.12.33

v6.12.34

v6.12.35

v6.12.36

v6.12.37

v6.12.38

v6.12.39

v6.12.4

v6.12.40

v6.12.41

v6.12.42

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.15

v6.15-rc1

v6.15-rc2

v6.15-rc3

v6.15-rc4

v6.15-rc5

v6.15-rc6

v6.15-rc7

v6.15.1

v6.15.10

v6.15.2

v6.15.3

v6.15.4

v6.15.5

v6.15.6

v6.15.7

v6.15.8

v6.15.9

v6.16

v6.16-rc1

v6.16-rc2

v6.16-rc3

v6.16-rc4

v6.16-rc5

v6.16-rc6

v6.16-rc7

v6.16.1

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-38722-0b22c223",
        "target": {
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "line_hashes": [
                "9235704723468020853730633995792363267",
                "32261742202642970195797360177451423394",
                "135106881644761277683027873569510591671",
                "16199608835617933110572149363415487899",
                "297853301258752924118123806315934439484",
                "17384225103178876723089411602539968585",
                "99026261802643988565546186901624759125",
                "248336481992726435095773162267004316402",
                "223367191924362721230002031532433096054",
                "1740321500359393431432639019816322367",
                "70816145036941332884554453691231267291",
                "265823431449404714868882720144041018103",
                "104097496258944612956542074299520477663",
                "158258015929273094493608044845551323679",
                "103176325616755452210081395573630261149",
                "178169607011064115176497049351138625639",
                "241335643824131732618886044792642172545",
                "300369858339691898851357544928019892402",
                "73028402307831516935288352965165355518",
                "239417582085874113503168339911621861695",
                "161368927209103400566686276527564454085",
                "8330112538112512897043093223405459282",
                "235748697550099977495509666880659260078",
                "193184620861635155465255297327488237316",
                "314848144088011921885521032405862989405",
                "323151965802455014180249170688056881909",
                "284556199475474128016821522634896809808"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33927f3d0ecdcff06326d6e4edb6166aed42811c",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2025-38722-294a4bb5",
        "target": {
            "function": "export_dmabuf",
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "length": 941.0,
            "function_hash": "312928985776265309560125459857506364550"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33927f3d0ecdcff06326d6e4edb6166aed42811c",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-38722-4f029c20",
        "target": {
            "function": "hl_release_dmabuf",
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "length": 335.0,
            "function_hash": "815516452689154539336475094714254564"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40deceb38f9db759772d1c289c28fd2a543f57fc",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-38722-7888ca6d",
        "target": {
            "function": "export_dmabuf",
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "length": 941.0,
            "function_hash": "312928985776265309560125459857506364550"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40deceb38f9db759772d1c289c28fd2a543f57fc",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-38722-bfff10fb",
        "target": {
            "function": "hl_release_dmabuf",
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "length": 335.0,
            "function_hash": "815516452689154539336475094714254564"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33927f3d0ecdcff06326d6e4edb6166aed42811c",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-38722-ee32494a",
        "target": {
            "file": "drivers/accel/habanalabs/common/memory.c"
        },
        "digest": {
            "line_hashes": [
                "9235704723468020853730633995792363267",
                "32261742202642970195797360177451423394",
                "135106881644761277683027873569510591671",
                "16199608835617933110572149363415487899",
                "297853301258752924118123806315934439484",
                "17384225103178876723089411602539968585",
                "99026261802643988565546186901624759125",
                "248336481992726435095773162267004316402",
                "223367191924362721230002031532433096054",
                "1740321500359393431432639019816322367",
                "70816145036941332884554453691231267291",
                "265823431449404714868882720144041018103",
                "104097496258944612956542074299520477663",
                "158258015929273094493608044845551323679",
                "103176325616755452210081395573630261149",
                "178169607011064115176497049351138625639",
                "241335643824131732618886044792642172545",
                "300369858339691898851357544928019892402",
                "73028402307831516935288352965165355518",
                "239417582085874113503168339911621861695",
                "161368927209103400566686276527564454085",
                "8330112538112512897043093223405459282",
                "235748697550099977495509666880659260078",
                "193184620861635155465255297327488237316",
                "314848144088011921885521032405862989405",
                "323151965802455014180249170688056881909",
                "284556199475474128016821522634896809808"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40deceb38f9db759772d1c289c28fd2a543f57fc",
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.12.43

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.15.11

Type: ECOSYSTEM
Events: Introduced

6.16.0

Fixed

6.16.2