Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s Xe graphics error handling can access a synchronization object after it is freed. A locally authenticated, low-privileged user may trigger the condition without user interaction, potentially compromising system confidentiality, integrity, and availability. The supplied CVSS score is 7.8.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on multi-user or otherwise locally accessible systems using drm/xe. It is not evidence of an internet-reachable emergency or known active exploitation. Accelerate normal kernel patching and require technical confirmation of vendor backports.
Technical view
The xe_migrate_clear error path referenced m->fence without holding the job mutex, so another operation could invalidate that fence and cause a use-after-free. The resolution retains and waits on the locally generated fence instead. The issue is local, low-complexity, low-privilege, and requires no user interaction according to CVSS 3.1.
Likely exposure
Exposure is limited to Linux kernels containing the affected drm/xe implementation. The supplied record lists 6.8, 6.12.25, 6.14.4, and 6.15 among affected versions, but its version data is ambiguous. Confirm applicability through the deployed distribution’s kernel advisory and package changelog.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source reports active exploitation. The CVSS vector indicates an attacker needs local, low-privileged access. Evidence supports a possible use-after-free, but does not establish reliable exploitation or a specific resulting primitive.
Researcher notes
The vulnerability is a possible use-after-free caused by reading m->fence outside the mutex-protected stability window during xe_migrate_clear error handling. The cited correction waits on the local fence. Three stable-tree commits are supplied, but no CWE, exploit evidence, affected hardware scope, or authoritative fixed-version table is included.
Mitigation direction
- Install a vendor-supported kernel update that incorporates the cited xe_migrate_clear fix.
- Check distribution guidance because the supplied affected-version mapping is incomplete and internally ambiguous.
- Prioritize systems allowing untrusted or broadly shared local access while updates are evaluated.
Validation and detection
- Inventory running kernel versions and identify systems containing or using the drm/xe implementation.
- Confirm the installed kernel package incorporates the applicable cited stable fix.
- Review vendor advisories and package changelogs for backports that may not change the displayed kernel version.
- After updating, verify systems booted into the remediated kernel rather than retaining the vulnerable kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2ac5f466f62892a7d1ac2d1a3eb6cd14efbe2f2dCVE reference, Linux
- https://git.kernel.org/stable/c/dc712938aa26b001f448d5e93f59d57fa80f2dbdCVE reference, Linux
- https://git.kernel.org/stable/c/20659d3150f1a2a258a173fe011013178ff2a197CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.