Skip to main content

Linux Kernel CVE-2025-38449

MEDIUM
Use After Free (CWE-416)
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Use After Free Memory Corruption
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local DRM device access (video/render group)
  2. Delivery
    Create GEM buffer and attach to framebuffer
  3. Exploit
    Close GEM handle prematurely
  4. Install
    dma-buf backing freed
  5. C2
    Trigger DRM atomic page flip
  6. Execute
    Kernel dereferences freed dma-buf in vmap path
  7. Impact
    Kernel OOPS or panic (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a local user account with read-write access to a DRM device node (typically /dev/dri/card0 or /dev/dri/renderD128), which on standard Linux desktop systems is granted to members of the 'video' or 'render' group. The system must be running a DRM driver that uses shadow planes for dma-buf vmapping - specifically drm_gem_shmem-based drivers. A DRM framebuffer backed by a GEM buffer object that has an associated dma-buf must be created and active. The attacker must have sufficient DRM permissions to both create framebuffers and explicitly close GEM handles. Limiting factors: AV:L (no network vector, physical or session-local access only), PR:L (unprivileged but must have DRM group membership), no remote triggering possible. Headless servers, systems with no GPU, and systems restricting /dev/dri/* to root are not affected.
Impact

The CVSS 5.5 Medium rating (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated for this vulnerability: local access with low privileges is required, and impact is purely availability (kernel crash or display subsystem failure). The EPSS score of 0.15% at the 4th percentile strongly aligns with the local-only access requirement - mass automated exploitation is not plausible. No CISA KEV listing and no public POC are identified at time of analysis. The absence of confidentiality or integrity impact limits blast radius to DoS. The primary realistic risk is on multi-tenant systems where unprivileged users have DRM/GPU device access, such as cloud gaming platforms, VDI environments, or shared Linux workstations. On headless servers without a display subsystem or GPU device nodes exposed to unprivileged users, this vulnerability has no practical impact. The four stable-tree patch commits confirm vendor acknowledgment and fix availability, reducing urgency for patched deployments.
Exploit ScenarioDerived

A local unprivileged user with membership in the 'video' or 'render' group opens a GEM buffer object on a DRM device backed by a drm_gem_shmem driver, attaches it to a framebuffer, then deliberately closes the GEM handle to trigger premature dma-buf release. When a subsequent DRM atomic commit (e.g., a page flip) vmap-s the framebuffer through the shadow plane path, the kernel dereferences the freed dma-buf pointer in dma_buf_vmap, generating a kernel OOPS that crashes the display subsystem or triggers a panic. No public proof-of-concept exists at time of analysis, though the detailed kernel stack trace in the CVE description provides a clear reproduction path for a kernel developer.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Use-after-free in the Linux kernel's DRM/GEM graphics subsystem allows a local user to crash the kernel by prematurely releasing a GEM handle while its buffer object remains attached to a DRM framebuffer, freeing the underlying dma-buf. Drivers using shadow planes to vmap the dma-buf during page flips (notably drm_gem_shmem-based drivers) then dereference the freed pointer during mode-setting, producing a kernel OOPS or WARNING and a denial of service. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.15% (4th percentile) confirms exploitation is rare and targeted rather than opportunistic.

RemediationAI

Apply the four upstream stable-tree patches from kernel.org: 08480e285c6a (https://git.kernel.org/stable/c/08480e285c6a82ce689008d643e4a51db0aaef8b), 3cf520d9860d (https://git.kernel.org/stable/c/3cf520d9860d4ec9f7f32068825da31f18dd3f25), 5307dce878d4 (https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741), and cb4c956a15f8 (https://git.kernel.org/stable/c/cb4c956a15f8b7f870649454771fc3761f504b5f). Distribution users should apply kernel updates as they are released by their vendor. As a compensating control prior to patching, restrict unprivileged access to DRM device nodes by removing non-essential users from the 'video' and 'render' groups, or apply udev rules to tighten permissions on /dev/dri/* to root-only - this eliminates the attack surface at the cost of disabling GPU/display access for those accounts. On headless servers with no DRM device nodes accessible to unprivileged users, no additional action is required beyond routine kernel update hygiene.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The DRM (Direct Rendering Manager) subsystem manages GPU resources through the GEM (Graphics Execution Manager) framework. GEM handles are per-process integer references to underlying GEM buffer objects; closing a handle decrements the object's reference count. When a GEM buffer object is exported as a dma-buf (DMA buffer sharing interface, used for zero-copy cross-subsystem sharing), releasing its GEM handle without first pinning a reference on behalf of the framebuffer frees the dma-buf prematurely. CWE-416 (Use After Free) manifests when the DRM atomic commit path calls drm_gem_fb_vmap → drm_gem_vmap → drm_gem_shmem_vmap → dma_buf_vmap on the now-freed dma-buf pointer. The fix acquires GEM handle references when building framebuffers, ensuring the framebuffer teardown path releases them rather than userspace handle closure. The issue predates but was made trivially reproducible by commit 1a148af06000 ('drm/gem-shmem: Use dma_buf from GEM object instance'), which widened dma-buf field usage. Affected CPE: cpe:2.3:o:linux:linux_kernel including 6.16-rc1 through 6.16-rc4.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access with DRM group membership required (PR:L, AV:L); kernel crash is availability-only with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat 7.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: Acquire references on GEM handles for framebuffers

A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below.

[ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]---

Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references.

Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before.

v2:

  • acquire the handle instead of the BO (Christian)
  • fix comment style (Christian)
  • drop the Fixes tag (Christian)
  • rename err_ gotos
  • add missing Link tag

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel runs in virtually all Linux server, desktop, and embedded environments
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.103 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.44 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.67 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.29 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.76 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.14 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/08480e285c6a82ce689008d643e4a51db0aaef8b PATCH https://git.kernel.org/stable/c/3cf520d9860d4ec9f7f32068825da31f18dd3f25 PATCH https://git.kernel.org/stable/c/5307dce878d4126e1b375587318955bd019c3741 PATCH https://git.kernel.org/stable/c/cb4c956a15f8b7f870649454771fc3761f504b5f ADVISORY https://access.redhat.com/errata/RHSA-2025:15447 ADVISORY https://access.redhat.com/errata/RHSA-2025:15661 ADVISORY https://access.redhat.com/errata/RHSA-2025:15785 ADVISORY https://access.redhat.com/errata/RHSA-2025:15786 ADVISORY https://access.redhat.com/errata/RHSA-2025:17122 ADVISORY https://access.redhat.com/errata/RHSA-2025:17123 ADVISORY https://access.redhat.com/errata/RHSA-2025:17159 ADVISORY https://access.redhat.com/errata/RHSA-2025:17192 ADVISORY https://access.redhat.com/errata/RHSA-2025:17241 ADVISORY https://access.redhat.com/errata/RHSA-2025:17570 ADVISORY https://access.redhat.com/errata/RHSA-2025:18043 ADVISORY https://access.redhat.com/errata/RHSA-2025:21667 ADVISORY https://access.redhat.com/errata/RHSA-2025:22752 ADVISORY https://vuldb.com/vuln/317754 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02853/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02923/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02969/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02997/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03011/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03023/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03204/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20577/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20586/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20601/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20994/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21179/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20309/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20560/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy