CVE-2025-37763 (GCVE-0-2025-37763)

Vulnerability from cvelistv5 – Published: 2025-05-01 13:07 – Updated: 2026-08-05 11:57
VLAI
Title
drm/imagination: take paired job reference
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: take paired job reference For paired jobs, have the fragment job take a reference on the geometry job, so that the geometry job cannot be freed until the fragment job has finished with it. The geometry job structure is accessed when the fragment job is being prepared by the GPU scheduler. Taking the reference prevents the geometry job being freed until the fragment job no longer requires it. Fixes a use after free bug detected by KASAN: [ 124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr] [ 124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < c90b95e12eb88d23740e5ea2c43d71675d17ac8d (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < b5a6f97a78e2fc008fd6503b7040cb7e1120b873 (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 4ba2abe154ef68f9612eee9d6fbfe53a1736b064 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.25 , ≤ 6.12.* (semver)
Unaffected: 6.14.4 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_job.c",
            "drivers/gpu/drm/imagination/pvr_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c90b95e12eb88d23740e5ea2c43d71675d17ac8d",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "b5a6f97a78e2fc008fd6503b7040cb7e1120b873",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "4ba2abe154ef68f9612eee9d6fbfe53a1736b064",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_job.c",
            "drivers/gpu/drm/imagination/pvr_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: take paired job reference\n\nFor paired jobs, have the fragment job take a reference on the\ngeometry job, so that the geometry job cannot be freed until\nthe fragment job has finished with it.\n\nThe geometry job structure is accessed when the fragment job is being\nprepared by the GPU scheduler. Taking the reference prevents the\ngeometry job being freed until the fragment job no longer requires it.\n\nFixes a use after free bug detected by KASAN:\n\n[  124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]\n[  124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the DRM_IOCTL_PVR_SUBMIT_JOBS ioctl on the PowerVR render node (/dev/dri/renderD*), requiring local access to the device file. There is no remote or network-facing path to this code.\nAC:L - The attacker controls both sides of the lifetime bug: they submit the paired geometry/fragment jobs, can make the geometry job complete (and be freed) immediately, and can stall the fragment job\u0027s prepare_job indefinitely with an unsignaled syncobj dependency, giving unlimited time to reallocate the freed pvr_job slot with controlled data. The bug also reproduces under ordinary rendering workloads.\nPR:L - SUBMIT_JOBS is flagged DRM_RENDER_ALLOW on a DRIVER_RENDER device, so no DRM master, authentication, or capability is required \u2014 only the ability to open the render node, which is granted to every unprivileged graphics client on Android/embedded targets and to normal local users on desktop systems.\nUI:N - The attacker submits their own job pairs and signals their own sync objects; no victim action or interaction is needed at any point.\nS:U - The use-after-free occurs in kernel memory owned by the DRM driver and the impact stays within the kernel\u0027s security authority, with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The freed pvr_job lives in a generic kmalloc cache that the attacker can reallocate with controlled content, after which the code dereferences an attacker-chosen `done_fence` pointer and walks `jfence-\u003equeue-\u003etimeline_ufo.fw_obj`, yielding a chained arbitrary-read primitive whose results are observable through the firmware sync objects.\nI:H - The same UAF gives an indirect call through `frag_job-\u003ebase.sched-\u003eops-\u003eprepare_job` and lets an attacker-influenced address/value pair be written into the GPU firmware command buffer as a UFO write target, providing control-flow hijack and write primitives from a groomed heap.\nA:H - Even without full exploitation the dangling dereference reliably oopses the kernel (as caught by KASAN), and the WARN_ON paths plus corrupted firmware command streams can wedge the GPU scheduler, crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:24.176Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c90b95e12eb88d23740e5ea2c43d71675d17ac8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5a6f97a78e2fc008fd6503b7040cb7e1120b873"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba2abe154ef68f9612eee9d6fbfe53a1736b064"
        }
      ],
      "title": "drm/imagination: take paired job reference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37763",
    "datePublished": "2025-05-01T13:07:05.042Z",
    "dateReserved": "2025-04-16T04:51:23.938Z",
    "dateUpdated": "2026-08-05T11:57:24.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37763",
      "date": "2026-08-07",
      "epss": "0.00191",
      "percentile": "0.08938"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37763\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T14:15:38.817\",\"lastModified\":\"2026-07-30T06:22:19.560\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/imagination: take paired job reference\\n\\nFor paired jobs, have the fragment job take a reference on the\\ngeometry job, so that the geometry job cannot be freed until\\nthe fragment job has finished with it.\\n\\nThe geometry job structure is accessed when the fragment job is being\\nprepared by the GPU scheduler. Taking the reference prevents the\\ngeometry job being freed until the fragment job no longer requires it.\\n\\nFixes a use after free bug detected by KASAN:\\n\\n[  124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]\\n[  124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/imagination: toma de referencia de trabajo emparejado. Para trabajos emparejados, el trabajo de fragmento toma una referencia en el trabajo de geometr\u00eda, de modo que este no pueda liberarse hasta que el trabajo de fragmento haya terminado con \u00e9l. Se accede a la estructura del trabajo de geometr\u00eda cuando el programador de GPU prepara el trabajo de fragmento. Tomar la referencia impide que el trabajo de geometr\u00eda se libere hasta que el trabajo de fragmento ya no la necesite. Corrige un error de use-after-free detectado por KASAN: [124.256386] ERROR: KASAN: slab-use-after-free en pvr_queue_prepare_job+0x108/0x868 [powervr] [124.264893] Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff0000084cb960 por la tarea kworker/u16:4/63\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_job.c\",\"drivers/gpu/drm/imagination/pvr_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"c90b95e12eb88d23740e5ea2c43d71675d17ac8d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"b5a6f97a78e2fc008fd6503b7040cb7e1120b873\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"4ba2abe154ef68f9612eee9d6fbfe53a1736b064\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_job.c\",\"drivers/gpu/drm/imagination/pvr_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.25\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.4\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.12.25\",\"matchCriteriaId\":\"CBBDA0D8-E64F-41F7-ADFF-19A22F63B1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.4\",\"matchCriteriaId\":\"29FA1A8E-1C2A-4B0B-B397-2C915ECDEDEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4ba2abe154ef68f9612eee9d6fbfe53a1736b064\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5a6f97a78e2fc008fd6503b7040cb7e1120b873\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c90b95e12eb88d23740e5ea2c43d71675d17ac8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:31:19+00:00",
      "cve": "CVE-2025-37763",
      "id": "CVE-2025-37763",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/imagination: take paired job reference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37763.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:16:14Z",
      "cve": "CVE-2025-37763",
      "id": "CVE-2025-37763",
      "initial_release_date": "2025-05-02T02:02:47Z",
      "product_status:known_affected": "451",
      "product_status:known_not_affected": "317",
      "product_status:recommended": "164",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37763",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37763.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.