LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38674: Revert "drm/prime: Use dma_buf from GEM object instance"

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/prime: Use dma_buf from GEM object instance" This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38674 is a Linux kernel graphics memory bug. A kernel graphics buffer pointer can become NULL after user space releases its final handle, causing a NULL-pointer dereference. The source indicates stability and availability risk, not confirmed data theft or remote compromise.

Executive priority

Treat as a kernel availability issue with uncertain severity. Prioritize normal kernel patching for Linux graphics-capable systems, especially shared workstations, GPU hosts, and systems where local denial of service has operational impact.

Technical view

The issue reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. drm/prime used drm_gem_object.dma_buf, but that field is unstable across the object lifetime and may become NULL. Prior framebuffer reference fixes only partially covered cases, especially GEM buffer objects without DRM framebuffers.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions or commits with DRM/GEM dma-buf graphics paths in use. The source lists Linux kernel 6.15, 6.15.9, and 6.16 data, but version-range detail is incomplete.

Exploitation context

The provided sources do not show active exploitation, public exploit availability, or CISA KEV listing. The described failure mode is a NULL-pointer dereference, which commonly maps to crash or denial-of-service impact, but exact attacker prerequisites are not stated.

Researcher notes

The key technical point is object lifetime mismatch: drm_gem_object.dma_buf can be cleared before all paths stop using it. The fix returns to using import_attach->dmabuf. Sources do not define privilege boundary, exploitability, or complete fixed-version mapping.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check distribution advisories for fixed kernel packages.
  • Do not rely on the earlier framebuffer workarounds alone.
  • If no package exists, track upstream and vendor guidance.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Check whether the referenced stable commits are present.
  • Review kernel logs for DRM or PRIME NULL-pointer dereference crashes.
  • Prioritize systems using GPU, DRM, or dma-buf workloads.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38674 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8, f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8unaffected
LinuxLinux6.15, 0, 6.15.9, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.