CVE-2025-38722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38722", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.033Z", "datePublished": "2025-09-04T15:33:15.641Z", "dateUpdated": "2026-10-30T12:22:16.988Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:16.988Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it. That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it). However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its ->release()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close. In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of ->release() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up. As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can't fail."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through the DRM_IOCTL_HL_MEMORY ioctl (HL_MEM_OP_EXPORT_DMABUF_FD) on the local /dev/accel/accelN character device, requiring local system access. No network or physical vector is involved.\nAC:L - The attacker owns both sides of the race \u2014 one thread issues the export ioctl while a sibling thread spins on close() of the deterministically-numbered fd in the same process's fd table \u2014 and the ioctl can be retried indefinitely until the window is won. No condition depends on external state the attacker cannot influence.\nPR:L - The ioctl is registered with flags 0, so drm_ioctl_permit(), accel_open(), hl_device_open() and hl_mem_ioctl() perform no capability, root, or DRM-auth check; only an open fd on the accel node is required, which unprivileged compute users and containerized AI workloads normally have.\nUI:N - The attacking process triggers the race entirely on its own with two of its own threads. No victim action, mount, or file open is needed.\nS:U - The premature reference drops corrupt kernel objects (struct hl_ctx, struct file) within the same kernel security authority. No IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The use-after-free lets the attacker reclaim the freed hl_ctx/struct file slab objects with controlled content and have the kernel dereference them (ctx->hdev, ctx->hpriv->file_priv->filp), and the premature fput() on the accel device file yields a DirtyCred-style file UAF enabling arbitrary kernel memory disclosure.\nI:H - The exporting thread performs atomic refcount increments (hl_ctx_get, atomic_inc, get_file) through pointers read out of freed, attacker-reclaimable memory, giving a write primitive at an influenceable address; a dangling struct file reference is a well-established path to control-flow hijack and privilege escalation.\nA:H - Losing the race yields a NULL pointer dereference in memhash_node_export_put() (ctx is still NULL) or refcount underflow and use-after-free on the context and device file, causing an immediate kernel oops/panic that any local user can trigger repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "versions": [{"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "5b0c23e9ec3e161a893d6ff9b4fad479e4539627", "status": "affected", "versionType": "git"}, {"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "d26058c2349d77d1ef179a2cc9752ca12004b6ff", "status": "affected", "versionType": "git"}, {"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "c07886761fd6251db6938d4e747002e3d150d231", "status": "affected", "versionType": "git"}, {"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc", "status": "affected", "versionType": "git"}, {"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8", "status": "affected", "versionType": "git"}, {"version": "db1a8dd916aac986871f6b873a3aefad906f383a", "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.43", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.11", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.2", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.16.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627"}, {"url": "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff"}, {"url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"}, {"url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"}, {"url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"}, {"url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}], "title": "habanalabs: fix UAF in export_dmabuf()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5b0c23e9ec3e161a893d6ff9b4fad479e4539627", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}, {"lessThan": "d26058c2349d77d1ef179a2cc9752ca12004b6ff", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}, {"lessThan": "c07886761fd6251db6938d4e747002e3d150d231", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}, {"lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}, {"lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}, {"lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c", "status": "affected", "version": "db1a8dd916aac986871f6b873a3aefad906f383a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accel/habanalabs/common/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.43", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.11", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "37BFE2B2-793C-4855-98A2-693DB8914D33", "versionEndExcluding": "6.12.43", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it. That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it). However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its ->release()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close. In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of ->release() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up. As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can't fail."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhabanalabs: corrige UAF en export_dmabuf()\n\nTan pronto como hubi\u00e9ramos insertado una referencia de archivo en la tabla de descriptores, otro hilo podr\u00eda cerrarla. Eso est\u00e1 bien para el caso en que todo lo que estamos haciendo es devolver ese descriptor al espacio de usuario (es una condici\u00f3n de carrera, pero es una condici\u00f3n de carrera del espacio de usuario y no hay nada que el kernel pueda hacer al respecto). Sin embargo, si despu\u00e9s de fd_install() seguimos con cualquier tipo de acceso a objetos que ser\u00edan destruidos al cerrar (ya sea la propia struct file o cualquier cosa destruida por su ->release()), tenemos un UAF.\n\ndma_buf_fd() es una combinaci\u00f3n de reservar un descriptor y fd_install(). habanalabs export_dmabuf() lo llama y luego procede a acceder a los objetos destruidos al cerrar. En particular, toma una referencia adicional a otra struct file que ser\u00e1 liberada como parte de ->release() para la nuestra; ese 'ser\u00e1' es en realidad 'podr\u00eda haber sido ya'.\n\nCorregir eso reservando el descriptor antes que nada y haciendo fd_install() solo cuando todo hubiera sido configurado. Como beneficio adicional, ya no tenemos la salida por fallo con el archivo ya creado, pero la referencia al archivo subyacente (as\u00ed como ->dmabuf_export_cnt, etc.) a\u00fan no tomada; a diferencia de dma_buf_fd(), fd_install() no puede fallar."}], "id": "CVE-2025-38722", "lastModified": "2026-10-30T13:18:07.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-04T16:15:41.993", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: habanalabs: fix UAF in export_dmabuf()", "id": "2393161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393161"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38722", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38722\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38722\nhttps://lore.kernel.org/linux-cve-announce/2025090400-CVE-2025-38722-de5f@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-05T14:02:46.535812+00:00", "updated": "2025-09-05T14:02:46.535876+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}