{"id":"CVE-2025-38095","state":"PUBLISHED","title":"dma-buf: insert memory barrier before updating num_fences","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: insert memory barrier before updating num_fences\n\nsmp_store_mb() inserts memory barrier after storing operation.\nIt is different with what the comment is originally aiming so Null\npointer dereference can be happened if memory update is reordered.","publishedAt":"2025-07-03T07:44:18.214Z","updatedAt":"2026-10-15T21:52:07.906Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"d0b7f11dd68b593bd970e5735be00e8d89bace30","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"3becc659f9cb76b481ad1fb71f54d5c8d6332d3f","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"c9d2b9a80d06a58f37e0dc8c827075639b443927","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"fe1bebd0edb22e3536cbc920ec713331d1367ad4","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"08680c4dadc6e736c75bc2409d833f03f9003c51","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"72c7d62583ebce7baeb61acce6057c361f73be4a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.192","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.140","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.92","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.30","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.8","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"]}],"references":["https://git.kernel.org/stable/c/90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f","https://git.kernel.org/stable/c/d0b7f11dd68b593bd970e5735be00e8d89bace30","https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f","https://git.kernel.org/stable/c/c9d2b9a80d06a58f37e0dc8c827075639b443927","https://git.kernel.org/stable/c/fe1bebd0edb22e3536cbc920ec713331d1367ad4","https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51","https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38095.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38095","state":"PUBLISHED","datePublished":"2025-07-03T07:44:18.214Z","dateUpdated":"2026-10-15T21:52:07.906Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.984Z"},"containers":{"cna":{"title":"dma-buf: insert memory barrier before updating num_fences","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: insert memory barrier before updating num_fences\n\nsmp_store_mb() inserts memory barrier after storing operation.\nIt is different with what the comment is originally aiming so Null\npointer dereference can be happened if memory update is reordered."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"d0b7f11dd68b593bd970e5735be00e8d89bace30","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"3becc659f9cb76b481ad1fb71f54d5c8d6332d3f","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"c9d2b9a80d06a58f37e0dc8c827075639b443927","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"fe1bebd0edb22e3536cbc920ec713331d1367ad4","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"08680c4dadc6e736c75bc2409d833f03f9003c51","versionType":"git"},{"version":"a590d0fdbaa56f482ff515e1040b6d9b1b200d63","status":"affected","lessThan":"72c7d62583ebce7baeb61acce6057c361f73be4a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.0","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.192","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.140","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.92","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.30","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.8","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f"},{"url":"https://git.kernel.org/stable/c/d0b7f11dd68b593bd970e5735be00e8d89bace30"},{"url":"https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f"},{"url":"https://git.kernel.org/stable/c/c9d2b9a80d06a58f37e0dc8c827075639b443927"},{"url":"https://git.kernel.org/stable/c/fe1bebd0edb22e3536cbc920ec713331d1367ad4"},{"url":"https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51"},{"url":"https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The race is driven entirely through local ioctls on a dma-buf or DRM render-node file descriptor (DMA_BUF_IOCTL_IMPORT_SYNC_FILE / EXPORT_SYNC_FILE / SYNC, and DRM_RENDER_ALLOW submit/wait/busy ioctls). No network or remote peer input reaches dma_resv_add_fence().\nAC:L - The attacker controls both sides of the race — one thread adds fences via DMA_BUF_IOCTL_IMPORT_SYNC_FILE while another iterates them locklessly via EXPORT_SYNC_FILE/SYNC — pinning threads to separate CPUs and looping indefinitely, and can groom the slab so the uninitialized slot holds a chosen value. The equivalent race was already demonstrated by the unprivileged igt/gem_busy/close-race testcase producing a GPF with slab poison, and affected weakly-ordered arm64 hardware is mainstream, not a rare configuration.\nPR:L - Only an unprivileged local user is needed: a dma-buf fd from /dev/dma_heap (accessible to every Android app) or a DRM render node (world/render-group accessible on desktops and containers with GPU passthrough), and all the relevant DRM ioctls are marked DRM_RENDER_ALLOW.\nUI:N - The attacker's own two threads perform both the fence addition and the lockless iteration on its own file descriptors. No victim action of any kind is required.\nS:U - The corruption occurs in kernel memory within the same security authority as the attacking process; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The reader dereferences an uninitialized/stale slab slot as a struct dma_fence *, giving reads at attacker-groomable addresses, and the bogus fence can be wrapped into a sync_file fd whose SYNC_IOC_FILE_INFO returns kernel-memory-derived strings and fields to userspace. Stale slots may also hold already-released fence pointers, a classic use-after-free read.\nI:H - kref_get_unless_zero() on the wild pointer performs an atomic increment at an attacker-influenced kernel address, and the subsequent dma_fence_is_signaled() makes an indirect call through fence->ops->signaled — an attacker-controlled function pointer — providing both a write primitive and control-flow hijack potential.\nA:H - The documented manifestations are a NULL pointer dereference (per the commit message) and a general protection fault from dereferencing garbage heap data (per the Fixes: commit's oops log), both of which panic or oops the kernel. The race can be re-triggered in a loop for repeated denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:59:28.799Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.15.192"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.1.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.6.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.12.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.14.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:58:27.686Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-38095","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:47:18.378470Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:52:07.906Z"}}]}}}