CVE-2025-38189 (GCVE-0-2025-38189)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00
VLAI
Title
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel Oops was recently reported by Mesa CI: [ 800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 [ 800.148619] Mem abort info: [ 800.151402] ESR = 0x0000000096000005 [ 800.155141] EC = 0x25: DABT (current EL), IL = 32 bits [ 800.160444] SET = 0, FnV = 0 [ 800.163488] EA = 0, S1PTW = 0 [ 800.166619] FSC = 0x05: level 1 translation fault [ 800.171487] Data abort info: [ 800.174357] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 800.179832] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 800.184873] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000 [ 800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight [ 800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d] [ 800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d] [ 800.267251] sp : ffffffc080003e60 [ 800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000 [ 800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020 [ 800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158 [ 800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000 [ 800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000 [ 800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c [ 800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0 [ 800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980 [ 800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382 [ 800.341859] Call trace: [ 800.344294] v3d_job_update_stats+0x60/0x130 [v3d] [ 800.349086] v3d_irq+0x124/0x2e0 [v3d] [ 800.352835] __handle_irq_event_percpu+0x58/0x218 [ 800.357539] handle_irq_event+0x54/0xb8 [ 800.361369] handle_fasteoi_irq+0xac/0x240 [ 800.365458] handle_irq_desc+0x48/0x68 [ 800.369200] generic_handle_domain_irq+0x24/0x38 [ 800.373810] gic_handle_irq+0x48/0xd8 [ 800.377464] call_on_irq_stack+0x24/0x58 [ 800.381379] do_interrupt_handler+0x88/0x98 [ 800.385554] el1_interrupt+0x34/0x68 [ 800.389123] el1h_64_irq_handler+0x18/0x28 [ 800.393211] el1h_64_irq+0x64/0x68 [ 800.396603] default_idle_call+0x3c/0x168 [ 800.400606] do_idle+0x1fc/0x230 [ 800.403827] cpu_startup_entry+0x40/0x50 [ 800.407742] rest_init+0xe4/0xf0 [ 800.410962] start_kernel+0x5e8/0x790 [ 800.414616] __primary_switched+0x80/0x90 [ 800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1) [ 800.424707] ---[ end trace 0000000000000000 ]--- [ 800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- This issue happens when the file descriptor is closed before the jobs submitted by it are completed. When the job completes, we update the global GPU stats and the per-fd GPU stats, which are exposed through fdinfo. If the file descriptor was closed, then the struct `v3d_file_priv` and its stats were already freed and we can't update the per-fd stats. Therefore, if the file descriptor was already closed, don't u ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 09a93cc4f7d1893777f6b788bffe60d64e4d5df7 , < c886784000934d5486621106da0614c85bcd76a8 (git)
Affected: 09a93cc4f7d1893777f6b788bffe60d64e4d5df7 , < 4f4701489d0f768a232b10d281491184f34bacf0 (git)
Affected: 09a93cc4f7d1893777f6b788bffe60d64e4d5df7 , < e1bc3a13bd775791cca0bb144d977b00f3598042 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c886784000934d5486621106da0614c85bcd76a8",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            },
            {
              "lessThan": "4f4701489d0f768a232b10d281491184f34bacf0",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            },
            {
              "lessThan": "e1bc3a13bd775791cca0bb144d977b00f3598042",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`\n\nThe following kernel Oops was recently reported by Mesa CI:\n\n[  800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588\n[  800.148619] Mem abort info:\n[  800.151402]   ESR = 0x0000000096000005\n[  800.155141]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  800.160444]   SET = 0, FnV = 0\n[  800.163488]   EA = 0, S1PTW = 0\n[  800.166619]   FSC = 0x05: level 1 translation fault\n[  800.171487] Data abort info:\n[  800.174357]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[  800.179832]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[  800.184873]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[  800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000\n[  800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[  800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[  800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight\n[  800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1  Debian 1:6.12.25-1+rpt1\n[  800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[  800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d]\n[  800.267251] sp : ffffffc080003e60\n[  800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000\n[  800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020\n[  800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158\n[  800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000\n[  800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000\n[  800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c\n[  800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0\n[  800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980\n[  800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382\n[  800.341859] Call trace:\n[  800.344294]  v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.349086]  v3d_irq+0x124/0x2e0 [v3d]\n[  800.352835]  __handle_irq_event_percpu+0x58/0x218\n[  800.357539]  handle_irq_event+0x54/0xb8\n[  800.361369]  handle_fasteoi_irq+0xac/0x240\n[  800.365458]  handle_irq_desc+0x48/0x68\n[  800.369200]  generic_handle_domain_irq+0x24/0x38\n[  800.373810]  gic_handle_irq+0x48/0xd8\n[  800.377464]  call_on_irq_stack+0x24/0x58\n[  800.381379]  do_interrupt_handler+0x88/0x98\n[  800.385554]  el1_interrupt+0x34/0x68\n[  800.389123]  el1h_64_irq_handler+0x18/0x28\n[  800.393211]  el1h_64_irq+0x64/0x68\n[  800.396603]  default_idle_call+0x3c/0x168\n[  800.400606]  do_idle+0x1fc/0x230\n[  800.403827]  cpu_startup_entry+0x40/0x50\n[  800.407742]  rest_init+0xe4/0xf0\n[  800.410962]  start_kernel+0x5e8/0x790\n[  800.414616]  __primary_switched+0x80/0x90\n[  800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1)\n[  800.424707] ---[ end trace 0000000000000000 ]---\n[  800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\n\nThis issue happens when the file descriptor is closed before the jobs\nsubmitted by it are completed. When the job completes, we update the\nglobal GPU stats and the per-fd GPU stats, which are exposed through\nfdinfo. If the file descriptor was closed, then the struct `v3d_file_priv`\nand its stats were already freed and we can\u0027t update the per-fd stats.\n\nTherefore, if the file descriptor was already closed, don\u0027t u\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by submitting GPU jobs via V3D_SUBMIT_CL/CSD/TFU/CPU ioctls on the local DRM render node /dev/dri/renderD*, then closing the fd. There is no remote or network-facing path to the v3d job scheduler.\nAC:L - The attacker controls both sides of the race \u2014 they choose the GPU job duration (a compute/render job can run for hundreds of ms up to the 500ms sched timeout) and choose when to close(2), and drm_sched_entity_destroy() provably returns without waiting on the hardware fence, so the free-before-IRQ ordering is deterministic. Heap grooming of the freed drm_file slab to control the read-back driver_priv value is likewise under attacker control.\nPR:L - All v3d submit ioctls are DRM_RENDER_ALLOW and render clients bypass the DRM_AUTH check in drm_ioctl(), so any unprivileged local user with render-node access can reach the path with no capabilities. This is the normal state for desktop/app users on Raspberry Pi 4/5 and Broadcom set-top SoCs, for Android-style GPU clients, and for containers/CI where renderD* is 0666 \u2014 the follow-up crash report shows UID 1000 running mpv.\nUI:N - The attacking process performs every step itself \u2014 submit a long GPU job, then close the file descriptor. No victim action or cooperation is required.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free: the freed struct drm_file is read to obtain driver_priv, and the freed v3d_file_priv is read (start_ns, enabled_ns, jobs_completed) during the read-modify-write. Reclaiming those slabs with attacker-chosen objects yields an attacker-steered read primitive at a groomable kernel address, warranting High.\nI:H - v3d_stats_update() writes into freed memory \u2014 seqcount increments, a 64-bit accumulate, a counter increment, and an 8-byte zero store \u2014 at an address derived from a use-after-free read, i.e. writes at driver_priv+0x158/0x570 where driver_priv is heap-groomable. That is a use-after-free write primitive leverageable for control-flow hijack, so High.\nA:H - The reported trace is a fatal kernel Oops in hardirq context, which escalates unconditionally to \"Kernel panic - not syncing: Oops: Fatal exception in interrupt\". Even without exploitation, the wild pointer dereference reliably panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:14.943Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c886784000934d5486621106da0614c85bcd76a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f4701489d0f768a232b10d281491184f34bacf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1bc3a13bd775791cca0bb144d977b00f3598042"
        }
      ],
      "title": "drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38189",
    "datePublished": "2025-07-04T13:37:14.428Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:14.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38189",
      "date": "2026-08-16",
      "epss": "0.00156",
      "percentile": "0.05283"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38189\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-04T14:15:25.883\",\"lastModified\":\"2026-07-30T06:22:58.867\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`\\n\\nThe following kernel Oops was recently reported by Mesa CI:\\n\\n[  800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588\\n[  800.148619] Mem abort info:\\n[  800.151402]   ESR = 0x0000000096000005\\n[  800.155141]   EC = 0x25: DABT (current EL), IL = 32 bits\\n[  800.160444]   SET = 0, FnV = 0\\n[  800.163488]   EA = 0, S1PTW = 0\\n[  800.166619]   FSC = 0x05: level 1 translation fault\\n[  800.171487] Data abort info:\\n[  800.174357]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\\n[  800.179832]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n[  800.184873]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n[  800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000\\n[  800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\\n[  800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\\n[  800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight\\n[  800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1  Debian 1:6.12.25-1+rpt1\\n[  800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\\n[  800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n[  800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d]\\n[  800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d]\\n[  800.267251] sp : ffffffc080003e60\\n[  800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000\\n[  800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020\\n[  800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158\\n[  800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000\\n[  800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000\\n[  800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n[  800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c\\n[  800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0\\n[  800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980\\n[  800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382\\n[  800.341859] Call trace:\\n[  800.344294]  v3d_job_update_stats+0x60/0x130 [v3d]\\n[  800.349086]  v3d_irq+0x124/0x2e0 [v3d]\\n[  800.352835]  __handle_irq_event_percpu+0x58/0x218\\n[  800.357539]  handle_irq_event+0x54/0xb8\\n[  800.361369]  handle_fasteoi_irq+0xac/0x240\\n[  800.365458]  handle_irq_desc+0x48/0x68\\n[  800.369200]  generic_handle_domain_irq+0x24/0x38\\n[  800.373810]  gic_handle_irq+0x48/0xd8\\n[  800.377464]  call_on_irq_stack+0x24/0x58\\n[  800.381379]  do_interrupt_handler+0x88/0x98\\n[  800.385554]  el1_interrupt+0x34/0x68\\n[  800.389123]  el1h_64_irq_handler+0x18/0x28\\n[  800.393211]  el1h_64_irq+0x64/0x68\\n[  800.396603]  default_idle_call+0x3c/0x168\\n[  800.400606]  do_idle+0x1fc/0x230\\n[  800.403827]  cpu_startup_entry+0x40/0x50\\n[  800.407742]  rest_init+0xe4/0xf0\\n[  800.410962]  start_kernel+0x5e8/0x790\\n[  800.414616]  __primary_switched+0x80/0x90\\n[  800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1)\\n[  800.424707] ---[ end trace 0000000000000000 ]---\\n[  800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\\n\\nThis issue happens when the file descriptor is closed before the jobs\\nsubmitted by it are completed. When the job completes, we update the\\nglobal GPU stats and the per-fd GPU stats, which are exposed through\\nfdinfo. If the file descriptor was closed, then the struct `v3d_file_priv`\\nand its stats were already freed and we can\u0027t update the per-fd stats.\\n\\nTherefore, if the file descriptor was already closed, don\u0027t u\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Evitar la desreferencia de puntero NULL en `v3d_job_update_stats()` El siguiente error del kernel fue informado recientemente por Mesa CI: [ 800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 [ 800.148619] Mem abort info: [ 800.151402] ESR = 0x0000000096000005 [ 800.155141] EC = 0x25: DABT (current EL), IL = 32 bits [ 800.160444] SET = 0, FnV = 0 [ 800.163488] EA = 0, S1PTW = 0 [ 800.166619] FSC = 0x05: level 1 translation fault [ 800.171487] Data abort info: [ 800.174357] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 800.179832] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 800.184873] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000 [ 800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight [ 800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d] [ 800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d] [ 800.267251] sp : ffffffc080003e60 [ 800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000 [ 800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020 [ 800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158 [ 800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000 [ 800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000 [ 800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c [ 800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0 [ 800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980 [ 800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382 [ 800.341859] Call trace: [ 800.344294] v3d_job_update_stats+0x60/0x130 [v3d] [ 800.349086] v3d_irq+0x124/0x2e0 [v3d] [ 800.352835] __handle_irq_event_percpu+0x58/0x218 [ 800.357539] handle_irq_event+0x54/0xb8 [ 800.361369] handle_fasteoi_irq+0xac/0x240 [ 800.365458] handle_irq_desc+0x48/0x68 [ 800.369200] generic_handle_domain_irq+0x24/0x38 [ 800.373810] gic_handle_irq+0x48/0xd8 [ 800.377464] call_on_irq_stack+0x24/0x58 [ 800.381379] do_interrupt_handler+0x88/0x98 [ 800.385554] el1_interrupt+0x34/0x68 [ 800.389123] el1h_64_irq_handler+0x18/0x28 [ 800.393211] el1h_64_irq+0x64/0x68 [ 800.396603] default_idle_call+0x3c/0x168 [ 800.400606] do_idle+0x1fc/0x230 [ 800.403827] cpu_startup_entry+0x40/0x50 [ 800.407742] rest_init+0xe4/0xf0 [ 800.410962] start_kernel+0x5e8/0x790 [ 800.414616] __primary_switched+0x80/0x90 [ 800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1) [ 800.424707] ---[fin del seguimiento 0000000000000000 ]--- [800.457313] ---[fin del p\u00e1nico del kernel - no se sincroniza: Oops: Excepci\u00f3n fatal en la interrupci\u00f3n ]--- Este problema ocurre cuando el descriptor de archivo se cierra antes de que se completen los trabajos enviados por \u00e9l. Al completarse el trabajo, actualizamos las estad\u00edsticas globales de la GPU y las estad\u00edsticas de la GPU por archivo de datos, que se exponen mediante fdinfo. Si el descriptor de archivo se cerr\u00f3, la estructura `v3d_file_priv` y sus estad\u00edsticas ya se liberaron, por lo que no podemos actualizar las estad\u00edsticas por archivo de datos. Por lo tanto, si el descriptor de archivo ya se cerr\u00f3, no se debe usar `--truncated---`.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"09a93cc4f7d1893777f6b788bffe60d64e4d5df7\",\"lessThan\":\"c886784000934d5486621106da0614c85bcd76a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09a93cc4f7d1893777f6b788bffe60d64e4d5df7\",\"lessThan\":\"4f4701489d0f768a232b10d281491184f34bacf0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09a93cc4f7d1893777f6b788bffe60d64e4d5df7\",\"lessThan\":\"e1bc3a13bd775791cca0bb144d977b00f3598042\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"22878579-C9F4-482B-BFD8-F0B83F7B7F7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4f4701489d0f768a232b10d281491184f34bacf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c886784000934d5486621106da0614c85bcd76a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1bc3a13bd775791cca0bb144d977b00f3598042\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:06+00:00",
      "cve": "CVE-2025-38189",
      "id": "CVE-2025-38189",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38189.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-12T16:57:41Z",
      "cve": "CVE-2025-38189",
      "id": "CVE-2025-38189",
      "initial_release_date": "2025-07-05T23:21:44Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "370",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38189",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38189.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.