CVE-2025-38731 (GCVE-0-2025-38731)
Vulnerability from cvelistv5
Published
2025-09-05 17:20
Modified
2025-09-29 05:56
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
References
Impacted products
Vendor Product Version
Linux Linux Version: b43e864af0d4e74636c0e1dee857ce3275a84829
Version: b43e864af0d4e74636c0e1dee857ce3275a84829
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77a946bf1af0e8110ef6e243394217a17f9b7e33",
              "status": "affected",
              "version": "b43e864af0d4e74636c0e1dee857ce3275a84829",
              "versionType": "git"
            },
            {
              "lessThan": "111fb43a557726079a67ce3ab51f602ddbf7097e",
              "status": "affected",
              "version": "b43e864af0d4e74636c0e1dee857ce3275a84829",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix vm_bind_ioctl double free bug\n\nIf the argument check during an array bind fails, the bind_ops are freed\ntwice as seen below. Fix this by setting bind_ops to NULL after freeing.\n\n==================================================================\nBUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\nFree of addr ffff88813bb9b800 by task xe_vm/14198\n\nCPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full)\nHardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x82/0xd0\n print_report+0xcb/0x610\n ? __virt_addr_valid+0x19a/0x300\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\n kasan_report_invalid_free+0xc8/0xf0\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\n check_slab_allocation+0x102/0x130\n kfree+0x10d/0x440\n ? should_fail_ex+0x57/0x2f0\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\n xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\n ? __lock_acquire+0xab9/0x27f0\n ? lock_acquire+0x165/0x300\n ? drm_dev_enter+0x53/0xe0 [drm]\n ? find_held_lock+0x2b/0x80\n ? drm_dev_exit+0x30/0x50 [drm]\n ? drm_ioctl_kernel+0x128/0x1c0 [drm]\n drm_ioctl_kernel+0x128/0x1c0 [drm]\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\n ? find_held_lock+0x2b/0x80\n ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]\n ? should_fail_ex+0x57/0x2f0\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\n drm_ioctl+0x352/0x620 [drm]\n ? __pfx_drm_ioctl+0x10/0x10 [drm]\n ? __pfx_rpm_resume+0x10/0x10\n ? do_raw_spin_lock+0x11a/0x1b0\n ? find_held_lock+0x2b/0x80\n ? __pm_runtime_resume+0x61/0xc0\n ? rcu_is_watching+0x20/0x50\n ? trace_irq_enable.constprop.0+0xac/0xe0\n xe_drm_ioctl+0x91/0xc0 [xe]\n __x64_sys_ioctl+0xb2/0x100\n ? rcu_is_watching+0x20/0x50\n do_syscall_64+0x68/0x2e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fa9acb24ded\n\n(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T05:56:58.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77a946bf1af0e8110ef6e243394217a17f9b7e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/111fb43a557726079a67ce3ab51f602ddbf7097e"
        }
      ],
      "title": "drm/xe: Fix vm_bind_ioctl double free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38731",
    "datePublished": "2025-09-05T17:20:30.618Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2025-09-29T05:56:58.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38731\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:42.277\",\"lastModified\":\"2025-09-08T16:25:59.157\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: Fix vm_bind_ioctl double free bug\\n\\nIf the argument check during an array bind fails, the bind_ops are freed\\ntwice as seen below. Fix this by setting bind_ops to NULL after freeing.\\n\\n==================================================================\\nBUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\nFree of addr ffff88813bb9b800 by task xe_vm/14198\\n\\nCPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full)\\nHardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x82/0xd0\\n print_report+0xcb/0x610\\n ? __virt_addr_valid+0x19a/0x300\\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\n kasan_report_invalid_free+0xc8/0xf0\\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\n check_slab_allocation+0x102/0x130\\n kfree+0x10d/0x440\\n ? should_fail_ex+0x57/0x2f0\\n ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\n xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]\\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\\n ? __lock_acquire+0xab9/0x27f0\\n ? lock_acquire+0x165/0x300\\n ? drm_dev_enter+0x53/0xe0 [drm]\\n ? find_held_lock+0x2b/0x80\\n ? drm_dev_exit+0x30/0x50 [drm]\\n ? drm_ioctl_kernel+0x128/0x1c0 [drm]\\n drm_ioctl_kernel+0x128/0x1c0 [drm]\\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\\n ? find_held_lock+0x2b/0x80\\n ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]\\n ? should_fail_ex+0x57/0x2f0\\n ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]\\n drm_ioctl+0x352/0x620 [drm]\\n ? __pfx_drm_ioctl+0x10/0x10 [drm]\\n ? __pfx_rpm_resume+0x10/0x10\\n ? do_raw_spin_lock+0x11a/0x1b0\\n ? find_held_lock+0x2b/0x80\\n ? __pm_runtime_resume+0x61/0xc0\\n ? rcu_is_watching+0x20/0x50\\n ? trace_irq_enable.constprop.0+0xac/0xe0\\n xe_drm_ioctl+0x91/0xc0 [xe]\\n __x64_sys_ioctl+0xb2/0x100\\n ? rcu_is_watching+0x20/0x50\\n do_syscall_64+0x68/0x2e0\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7fa9acb24ded\\n\\n(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/111fb43a557726079a67ce3ab51f602ddbf7097e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/77a946bf1af0e8110ef6e243394217a17f9b7e33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.