Security readout for executives and security teams
Plain-English summary
A Linux Nouveau graphics-driver flaw can reuse memory after it has been freed while processing a large GPU RPC. The supplied CVSS assessment indicates a low-privileged local attacker could potentially compromise confidentiality, integrity, and availability without user interaction. Systems not using the affected Nouveau code path are less likely to be exposed.
Executive priority
Treat this as a high-priority kernel update for multi-user workstations, GPU servers, and other systems using Nouveau where untrusted users obtain local access. Prioritize internet-facing services only when they also provide a path to local low-privileged execution. Deprioritize systems confirmed not to load the relevant driver path.
Technical view
During fragmented transmission of a large RPC, r535_gsp_rpc_send() prematurely releases the caller’s RPC container after the initial fragment. Remaining fragments then access freed memory. The kernel fix allocates a temporary container for the first fragment and delays freeing the caller’s container until all fragments are sent successfully.
Likely exposure
Exposure is most plausible on Linux systems using Nouveau’s affected r535 GSP RPC path, generally involving supported NVIDIA hardware. The bundle lists version markers including 6.7, 6.15.4, and 6.16, but its flattened range is ambiguous. Confirm exact affected and corrected distributor kernels through vendor guidance or fix-commit comparison.
Exploitation context
The CVSS vector describes local access, low privileges, low complexity, no user interaction, and potentially high confidentiality, integrity, and availability impact. The supplied record is not in KEV, and no cited source establishes active exploitation, public weaponization, or practical exploit reliability.
Researcher notes
The source clearly documents a kernel use-after-free and its lifetime-management correction. It does not identify a CWE, precise triggering interface, required NVIDIA hardware or firmware combinations, observed crashes, exploit primitives, or reliable privilege-escalation evidence. Exact exposure therefore requires code, package, and runtime-driver validation.
Mitigation direction
- Install a vendor-supported kernel package that incorporates the referenced Nouveau fixes.
- Check distributor guidance for exact corrected releases because the supplied version range is ambiguous.
- Restrict unnecessary local accounts on potentially affected GPU systems until remediation is complete.
- Reboot into the corrected kernel when required by the vendor update process.
Validation and detection
- Inventory running kernel versions and identify systems actively using the Nouveau driver.
- Determine whether the affected r535 GSP RPC code is present in each packaged kernel.
- Compare vendor source or changelogs with the two referenced fix commits.
- After remediation, confirm systems are running the corrected kernel, not merely storing it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Container behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-38187 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1CVE reference, Linux
- https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.