CVE-2025-38511 (GCVE-0-2025-38511)
Vulnerability from cvelistv5
Published
2025-08-16 10:54
Modified
2025-08-16 10:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/pf: Clear all LMTT pages on alloc
Our LMEM buffer objects are not cleared by default on alloc
and during VF provisioning we only setup LMTT PTEs for the
actually provisioned LMEM range. But beyond that valid range
we might leave some stale data that could either point to some
other VFs allocations or even to the PF pages.
Explicitly clear all new LMTT page to avoid the risk that a
malicious VF would try to exploit that gap.
While around add asserts to catch any undesired PTE overwrites
and low-level debug traces to track LMTT PT life-cycle.
(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
References
Impacted products
{ "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_lmtt.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8", "status": "affected", "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "versionType": "git" }, { "lessThan": "5d21892c2e15b6a27f8bc907693eca7c6b7cc269", "status": "affected", "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "versionType": "git" }, { "lessThan": "705a412a367f383430fa34bada387af2e52eb043", "status": "affected", "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_lmtt.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.39", "versionType": "semver" }, { "lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.39", "versionStartIncluding": "6.8", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.15.7", "versionStartIncluding": "6.8", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.16", "versionStartIncluding": "6.8", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Clear all LMTT pages on alloc\n\nOur LMEM buffer objects are not cleared by default on alloc\nand during VF provisioning we only setup LMTT PTEs for the\nactually provisioned LMEM range. But beyond that valid range\nwe might leave some stale data that could either point to some\nother VFs allocations or even to the PF pages.\n\nExplicitly clear all new LMTT page to avoid the risk that a\nmalicious VF would try to exploit that gap.\n\nWhile around add asserts to catch any undesired PTE overwrites\nand low-level debug traces to track LMTT PT life-cycle.\n\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)" } ], "providerMetadata": { "dateUpdated": "2025-08-16T10:54:53.346Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8" }, { "url": "https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269" }, { "url": "https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043" } ], "title": "drm/xe/pf: Clear all LMTT pages on alloc", "x_generator": { "engine": "bippy-1.2.0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2025-38511", "datePublished": "2025-08-16T10:54:53.346Z", "dateReserved": "2025-04-16T04:51:24.022Z", "dateUpdated": "2025-08-16T10:54:53.346Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-38511\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T11:15:44.140\",\"lastModified\":\"2025-08-18T20:16:28.750\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/pf: Clear all LMTT pages on alloc\\n\\nOur LMEM buffer objects are not cleared by default on alloc\\nand during VF provisioning we only setup LMTT PTEs for the\\nactually provisioned LMEM range. But beyond that valid range\\nwe might leave some stale data that could either point to some\\nother VFs allocations or even to the PF pages.\\n\\nExplicitly clear all new LMTT page to avoid the risk that a\\nmalicious VF would try to exploit that gap.\\n\\nWhile around add asserts to catch any undesired PTE overwrites\\nand low-level debug traces to track LMTT PT life-cycle.\\n\\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/pf: Borrar todas las p\u00e1ginas LMTT al asignar. Nuestros objetos de b\u00fafer LMEM no se borran por defecto al asignar, y durante el aprovisionamiento de VF solo configuramos PTE LMTT para el rango LMEM realmente aprovisionado. Sin embargo, m\u00e1s all\u00e1 de ese rango v\u00e1lido, podr\u00edamos dejar datos obsoletos que podr\u00edan apuntar a otras asignaciones de VF o incluso a las p\u00e1ginas PF. Borre expl\u00edcitamente todas las p\u00e1ginas LMTT nuevas para evitar el riesgo de que una VF maliciosa intente explotar esa brecha. Mientras est\u00e9 disponible, agregue aserciones para detectar cualquier sobrescritura de PTE no deseada y trazas de depuraci\u00f3n de bajo nivel para rastrear el ciclo de vida de las PT LMTT. (Seleccionado de el commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…