CVE-2025-38187

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38187", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.992Z", "datePublished": "2025-07-04T13:37:13.126Z", "dateUpdated": "2026-10-21T12:36:49.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:36:49.089Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller's RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller's container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the nouveau GSP-RM RPC layer, reached through local GPU device operations and power-management transitions (DRM device open/close driving runtime PM, or system suspend/resume). There is no network or remote-peer input path to `r535_gsp_rpc_push()`.\nAC:L - The free and the subsequent use are sequential within the same thread, so no race must be won \u2014 every large RPC (any FBSR memlist over ~33 MB, which is the normal case on GSP GPUs) deterministically reads freed memory. Reallocation of the freed order-5/6 block by the immediately following `r535_gsp_rpc_get()` is likewise deterministic behaviour of the buddy allocator, and heap grooming from another CPU is fully under attacker control.\nPR:L - An unprivileged local user with access to the DRM render node can drive nouveau runtime-PM suspend/resume cycles (which invoke `r535_gsp_fini(suspend=true)` \u2192 `fbsr->suspend` \u2192 the large memlist RPC) simply by opening and closing the device; on typical desktop/laptop systems an active local session can also request system suspend via logind without elevated rights.\nUI:N - No victim action is needed \u2014 GPU runtime suspend fires automatically on idle and can be induced by the attacker's own process lifecycle, so the vulnerable path executes without any other user interacting with the system.\nS:U - The use-after-free and its consequences are contained within the kernel's own security authority; the corrupted DMA descriptors are consumed by the GPU within the driver's existing mappings rather than crossing a VM or IOMMU security boundary.\nC:H - Up to hundreds of kilobytes of freed kernel heap are read and transmitted verbatim to the GSP firmware as RPC continuation records, and because those bytes are interpreted as physical page descriptors for the VRAM save/restore DMA, a groomed heap lets an attacker steer GPU DMA reads at arbitrary memory.\nI:H - The stale data read from the freed container becomes the PTE array that GSP-RM uses as DMA targets for writing saved VRAM contents, so attacker-controlled reallocation of that buffer yields arbitrary physical-memory writes performed by the GPU; even without grooming the driver corrupts its own freshly allocated container through the overlapping memcpy.\nA:H - The use-after-free reliably corrupts the FBSR memlist sent to GSP-RM, producing firmware hangs, RPC timeouts, WARN/oops and failed resume that leave the GPU and often the machine unusable, and it trips KASAN/hardened-usercopy style fatal reports."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"], "versions": [{"version": "176fdcbddfd288408ce8571c1760ad618d962096", "lessThan": "69270d24af7694494ac4116bcad30a812ca49ca7", "status": "affected", "versionType": "git"}, {"version": "176fdcbddfd288408ce8571c1760ad618d962096", "lessThan": "cd4677407c0ee250fc21e36439c8a442ddd62cc1", "status": "affected", "versionType": "git"}, {"version": "176fdcbddfd288408ce8571c1760ad618d962096", "lessThan": "9802f0a63b641f4cddb2139c814c2e95cb825099", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/69270d24af7694494ac4116bcad30a812ca49ca7"}, {"url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1"}, {"url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}], "title": "drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "69270d24af7694494ac4116bcad30a812ca49ca7", "status": "affected", "version": "176fdcbddfd288408ce8571c1760ad618d962096", "versionType": "git"}, {"lessThan": "cd4677407c0ee250fc21e36439c8a442ddd62cc1", "status": "affected", "version": "176fdcbddfd288408ce8571c1760ad618d962096", "versionType": "git"}, {"lessThan": "9802f0a63b641f4cddb2139c814c2e95cb825099", "status": "affected", "version": "176fdcbddfd288408ce8571c1760ad618d962096", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9070DE87-9D2B-479F-AD76-596EB6C842D8", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller's RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller's container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/nouveau: se corrige un error de use-after-free en r535_gsp_rpc_push(). El contenedor RPC se libera tras pasarse a r535_gsp_rpc_send(). Al enviar el fragmento inicial de una RPC grande y pasar el contenedor RPC del emisor, este se liberar\u00e1 prematuramente. Por lo tanto, los intentos posteriores de enviar los fragmentos restantes resultar\u00e1n en un error de use-after-free. Asigne un contenedor RPC temporal para almacenar el fragmento inicial de una RPC grande durante el env\u00edo. Libere el contenedor del emisor cuando todos los fragmentos se hayan enviado correctamente. [Rebase sobre los cambios de Blackwell. - Danilo]"}], "id": "CVE-2025-38187", "lastModified": "2026-10-21T13:18:09.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-04T14:15:25.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69270d24af7694494ac4116bcad30a812ca49ca7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()", "id": "2376404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376404"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\nThe RPC container is released after being passed to r535_gsp_rpc_send().\nWhen sending the initial fragment of a large RPC and passing the\ncaller's RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller's container when all fragments\nare successfully sent.\n[ Rebase onto Blackwell changes. - Danilo ]"], "name": "CVE-2025-38187", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38187\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38187\nhttps://lore.kernel.org/linux-cve-announce/2025070413-CVE-2025-38187-dafd@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T21:47:47.810696+00:00", "updated": "2025-07-13T21:47:47.810783+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}