Look up another CVE · open CVE-2025-38449 in the interactive tracker
CVE-2025-38449
drm/gem: Acquire references on GEM handles for framebuffers
Published 2025-07-25 (15 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2025-38449 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-5975-1 · 2025-08-13 · text | 6.12.41-1 | Update the kernel and reboot. DSA-5975-1 shipped the fix on 2025-08-13, in 6.12.41-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below. [ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]--- Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references. Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before. v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/drm_gem.c
drivers/gpu/drm/drm_gem_framebuffer_helper.c
drivers/gpu/drm/drm_internal.h
- What this is
- DRM DRIVERS AND MISC GPU PATCHESMAINTAINERS section matched on drivers/gpu/drm/ · Maintained
- Kernel module
- drm
Check it on the machine
grep -w CONFIG_DRM /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w drmPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixieBnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- B
- built in on some, a module on others, absent on the rest
- Build switch
- CONFIG_DRM
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-07-25 (15 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.12 | 6.6.99 | cb4c956a15f8 |
| 3.12 | 6.12.39 | 08480e285c6a |
| 3.12 | 6.15.7 | 3cf520d9860d |
| 3.12 | 6.16 | 5307dce878d4 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-5975-1 | 2025-08-13 | trixie 6.12.41-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerability is triggered purely through DRM ioctls (PRIME_FD_TO_HANDLE, ADDFB2, GEM_CLOSE, MODE_ATOMIC/PAGE_FLIP) on a local device node /dev/dri/card*. There is no network or remote-peer data path into drm_gem_fb_init_with_funcs() or drm_gem_object_handle_put_unlocked().
- AC:LAttack complexity, low
- The attacker performs the entire sequence themselves — import a dma-buf, create a framebuffer, close the GEM handle, then commit the framebuffer — and the resulting release of the still-referenced dma-buf is deterministic, with no race or memory-layout condition outside the attacker's control. Where a window is involved (begin_fb_access in prepare_planes vs. end_fb_access in cleanup_planes), the attacker drives both sides from their own threads.
- PR:LPrivileges required, low
- Only an unprivileged local account with access to a DRM primary node is needed (video group, active-seat ACL, Android graphics group); ADDFB2/RMFB/GEM_CLOSE require no master or auth flags at all. DRM master, needed for the atomic commit, is handed out by drm_master_open() to the first opener of the node with no capability check, and is also available via DRM leases — no real root is required.
- UI:NUser interaction, none
- A single attacker-controlled process performs every step — buffer import, framebuffer creation, handle close, and the mode-setting commit. No victim action or cooperating process is involved.
- S:UScope, unchanged
- The premature release and subsequent misuse of the GEM object's dma-buf occur entirely within the kernel's own security authority on the same host. No VM, IOMMU, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- This is a reference-counting/lifetime defect that releases the dma-buf backing a framebuffer that remains live and in active use by plane state, the scanout engine and shadow-plane kernel mappings — a use-after-free-class flaw. Such premature release of a GEM/dma-buf backing store, with attacker-controlled heap grooming via DUMB_CREATE and repeated import/close cycles, is leverageable into disclosure of reallocated kernel memory contents.
- I:HIntegrity impact, high
- The same missing handle reference lets the kernel continue writing through stale framebuffer state (shadow-plane blits, damage handling) into storage whose backing reference has been dropped, and the unguarded dma_buf_end_cpu_access() path performs an indirect call through dmabuf->ops on a released/invalid dma_buf. This gives a memory-corruption and control-flow primitive rather than a benign failure.
- A:HAvailability impact, high
- The documented result is a WARNING splat in dma_buf_vmap() (a panic on the widely deployed panic_on_warn configurations) and a kernel oops — dma_buf_end_cpu_access() only does WARN_ON(!dmabuf) without returning and then dereferences dmabuf->resv and dmabuf->ops. Any local user with DRM access can trigger this repeatedly to crash the machine.