CVE-2025-38511 (GCVE-0-2025-38511)

Vulnerability from cvelistv5 – Published: 2025-08-16 10:54 – Updated: 2026-08-05 12:02
VLAI
Title
drm/xe/pf: Clear all LMTT pages on alloc
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b1d20405821812ad70d95eefe58cadc6d50b0917 , < ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8 (git)
Affected: b1d20405821812ad70d95eefe58cadc6d50b0917 , < 5d21892c2e15b6a27f8bc907693eca7c6b7cc269 (git)
Affected: b1d20405821812ad70d95eefe58cadc6d50b0917 , < 705a412a367f383430fa34bada387af2e52eb043 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.39 , ≤ 6.12.* (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "5d21892c2e15b6a27f8bc907693eca7c6b7cc269",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            },
            {
              "lessThan": "705a412a367f383430fa34bada387af2e52eb043",
              "status": "affected",
              "version": "b1d20405821812ad70d95eefe58cadc6d50b0917",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_lmtt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Clear all LMTT pages on alloc\n\nOur LMEM buffer objects are not cleared by default on alloc\nand during VF provisioning we only setup LMTT PTEs for the\nactually provisioned LMEM range. But beyond that valid range\nwe might leave some stale data that could either point to some\nother VFs allocations or even to the PF pages.\n\nExplicitly clear all new LMTT page to avoid the risk that a\nmalicious VF would try to exploit that gap.\n\nWhile around add asserts to catch any undesired PTE overwrites\nand low-level debug traces to track LMTT PT life-cycle.\n\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing code on a system with an Xe SR-IOV Virtual Function assigned (a guest VM or container), driving GPU accesses to LMEM offsets above the provisioned quota via the VF\u0027s own GGTT/PPGTT entries. No network protocol is involved.\nAC:L - The gap is deterministic and present on every VF provisioning \u2014 no race, no timing window; with tens of thousands of uninitialized dwords and only a 1-bit validity check, thousands of usable rogue mappings are essentially guaranteed, and the VF can additionally groom VRAM with crafted PTE patterns before re-provisioning.\nPR:L - The attacker needs control of a VF (guest-side driver privileges to emit out-of-range LMEM offsets) but holds no privileges whatsoever on the host/PF that owns the vulnerable LMTT; relative to the vulnerable component this is a low, tenant-level authorization.\nUI:N - No victim action is required at exploit time \u2014 the VF simply accesses LMEM beyond its quota. PF-side SR-IOV provisioning is pre-existing administrative setup in any deployment where this code runs.\nS:C - The LMTT is the only hardware mechanism isolating a VF\u0027s local memory from the PF and other VFs, so bypassing it lets a guest reach memory belonging to the host and to other tenants \u2014 the DMA/IOMMU-boundary-bypass case, directly analogous to a guest-to-host escape.\nC:H - Stale valid PTEs map arbitrary 2 MiB-aligned pages across the device\u0027s entire local memory address space (32/128 GiB for 2L, 256 TiB for ML), letting the VF read PF driver allocations and other tenants\u0027 framebuffers and compute data.\nI:H - LMTT PTEs carry no read-only bit, so the VF also writes through the rogue mappings; landing on the LMTT PD/PT pages themselves yields deterministic arbitrary VRAM mapping, and landing on PF/other-VF PPGTT page-table BOs (allocated in VRAM on dGFX) lets the VF redirect another domain\u0027s GPU accesses, including to host system memory.\nA:H - Corrupting PF or peer-VF VRAM \u2014 GPU page tables, GuC context state and firmware images all live in local memory \u2014 causes GPU hangs, engine resets, wedged-device conditions and host driver failure, denying service to the host and every other tenant on the GPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:32.680Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269"
        },
        {
          "url": "https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043"
        }
      ],
      "title": "drm/xe/pf: Clear all LMTT pages on alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38511",
    "datePublished": "2025-08-16T10:54:53.346Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:32.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38511",
      "date": "2026-08-09",
      "epss": "0.00151",
      "percentile": "0.04764"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38511\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T11:15:44.140\",\"lastModified\":\"2026-07-30T06:23:23.297\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/pf: Clear all LMTT pages on alloc\\n\\nOur LMEM buffer objects are not cleared by default on alloc\\nand during VF provisioning we only setup LMTT PTEs for the\\nactually provisioned LMEM range. But beyond that valid range\\nwe might leave some stale data that could either point to some\\nother VFs allocations or even to the PF pages.\\n\\nExplicitly clear all new LMTT page to avoid the risk that a\\nmalicious VF would try to exploit that gap.\\n\\nWhile around add asserts to catch any undesired PTE overwrites\\nand low-level debug traces to track LMTT PT life-cycle.\\n\\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/pf: Borrar todas las p\u00e1ginas LMTT al asignar. Nuestros objetos de b\u00fafer LMEM no se borran por defecto al asignar, y durante el aprovisionamiento de VF solo configuramos PTE LMTT para el rango LMEM realmente aprovisionado. Sin embargo, m\u00e1s all\u00e1 de ese rango v\u00e1lido, podr\u00edamos dejar datos obsoletos que podr\u00edan apuntar a otras asignaciones de VF o incluso a las p\u00e1ginas PF. Borre expl\u00edcitamente todas las p\u00e1ginas LMTT nuevas para evitar el riesgo de que una VF maliciosa intente explotar esa brecha. Mientras est\u00e9 disponible, agregue aserciones para detectar cualquier sobrescritura de PTE no deseada y trazas de depuraci\u00f3n de bajo nivel para rastrear el ciclo de vida de las PT LMTT. (Seleccionado de el commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_lmtt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b1d20405821812ad70d95eefe58cadc6d50b0917\",\"lessThan\":\"ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b1d20405821812ad70d95eefe58cadc6d50b0917\",\"lessThan\":\"5d21892c2e15b6a27f8bc907693eca7c6b7cc269\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b1d20405821812ad70d95eefe58cadc6d50b0917\",\"lessThan\":\"705a412a367f383430fa34bada387af2e52eb043\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_lmtt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.39\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.12.39\",\"matchCriteriaId\":\"10807776-5E00-40EF-A71B-8298F5EF80E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"F9C46937-5FA9-4335-AD7B-E7FC29453CE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:03:55+00:00",
      "cve": "CVE-2025-38511",
      "id": "CVE-2025-38511",
      "initial_release_date": "2025-08-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/pf: Clear all LMTT pages on alloc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38511.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-31T01:09:01Z",
      "cve": "CVE-2025-38511",
      "id": "CVE-2025-38511",
      "initial_release_date": "2025-08-16T23:23:04Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "393",
      "product_status:recommended": "289",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38511",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38511.json",
      "version": "33"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.