LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages()

In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in the Linux Xen grant-device DMA-BUF path can leave the kernel using memory after it has been freed. A locally authenticated user able to reach this functionality could potentially crash the host or compromise data and system integrity. Network-only attackers are not directly exposed according to the supplied CVSS vector.

Executive priority

Prioritize affected multi-user Xen hosts and systems granting untrusted users local access. Treat remediation as high priority because successful triggering may affect all three security properties at kernel scope. Validate distribution backports before declaring exposure or closure; version strings alone may be misleading.

Technical view

dmabuf_exp_from_pages() called dma_buf_fd(), exposing a descriptor before setup completed. Another thread could close that descriptor, trigger object release, and leave the original thread accessing freed gntdev_dmabuf-related objects. The correction reserves the descriptor first and delays fd_install() until object setup is complete.

Likely exposure

Exposure is most likely on affected Linux kernels where Xen gntdev DMA-BUF export functionality is present and reachable by a low-privileged local user. The bundle identifies affected releases including 4.19, 6.12.42, 6.15.10, 6.16.1, and 6.17, but distribution backports may change actual status.

Exploitation context

The supplied CVSS 3.1 vector rates this as local, low-complexity, low-privilege, with no user interaction and potentially high confidentiality, integrity, and availability impact. The bundle marks it absent from KEV and provides no cited evidence of active exploitation. That absence does not prove exploitation has never occurred.

Researcher notes

The vulnerable window begins when dma_buf_fd() installs the descriptor and ends after subsequent accesses to close-released objects. The fix changes object-lifetime ordering by reserving the descriptor before setup and installing it only afterward. The supplied records do not identify a CWE, public proof of concept, observed attacks, or vendor-specific package mappings.

Mitigation direction

  • Identify kernel packages containing the applicable stable-kernel correction commits.
  • Apply vendor-supported kernel updates that include the fix, then reboot into the updated kernel.
  • Consult distribution or appliance vendor guidance for backport status and supported remediation.
  • Restrict unnecessary local access to affected Xen functionality while remediation is pending.

Validation and detection

  • Record running kernel versions across Xen hosts and compare them with vendor advisories.
  • Check package changelogs or source history for the supplied stable-kernel commit identifiers.
  • After updating, confirm each host booted the remediated kernel rather than an older installed image.
  • Verify operational monitoring shows no related kernel faults after remediation.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38595 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38595Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa240d6e42e28c34fdc34b3a98ca838a31c939901, a240d6e42e28c34fdc34b3a98ca838a31c939901, a240d6e42e28c34fdc34b3a98ca838a31c939901, a240d6e42e28c34fdc34b3a98ca838a31c939901unaffected
LinuxLinux4.19, 0, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.