Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Intel Xe graphics driver can free the same kernel memory twice when an array-based virtual-memory bind request fails validation. A local, low-privileged user or process could trigger kernel memory corruption, potentially affecting system confidentiality, integrity, or availability. The supplied evidence does not establish practical exploitation.
Executive priority
Prioritize affected multi-user workstations, shared compute systems, and environments running untrusted local workloads. Patch through normal high-severity kernel timelines, accelerating where low-privileged users can access Xe graphics devices. Internet-only attackers are not directly supported by the supplied attack vector, but compromised local applications could potentially reach the vulnerable interface.
Technical view
The xe_vm_bind_ioctl path frees bind_ops after a failed array-bind argument check, then reaches another free of the same allocation. KASAN confirmed the double free. The correction sets bind_ops to NULL after the first free. CVSS 3.1 rates it 7.8 because triggering is local, low-complexity, low-privilege, and requires no user interaction.
Likely exposure
Exposure is limited to systems running an affected Linux kernel with the Intel Xe DRM driver and accessible DRM ioctl interface. The bundle identifies affected Linux versions beginning with 6.15, but its flattened version data does not reliably establish every fixed boundary or distribution backport. Confirm status with the operating-system vendor.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit. The documented trigger is a failed argument check during an array VM bind operation. Actual privilege-escalation feasibility is not demonstrated in the bundle; the confirmed result is kernel double-free detection by KASAN.
Researcher notes
The strongest evidence is a KASAN trace showing a double free in xe_vm_bind_ioctl and two upstream stable fix references. The CVSS vector claims high confidentiality, integrity, and availability impact, but the bundle does not document a working privilege escalation, code execution, or denial-of-service exploit. Exact downstream kernel exposure depends on vendor backports.
Mitigation direction
- Install a vendor-supported kernel containing the cited stable fix or an equivalent distribution backport.
- Reboot into the updated kernel; installing packages alone does not replace the running kernel.
- If updating is delayed, assess whether access to affected Xe DRM devices can be safely restricted.
- Consult the Linux distribution or hardware-platform vendor for exact package and backport guidance.
Validation and detection
- Record the running kernel version and distribution package release.
- Determine whether the xe kernel module is loaded and Intel Xe graphics hardware is present.
- Check vendor advisories or package changelogs for backports of the two cited stable commits.
- After remediation, confirm the updated kernel is active and the affected package is no longer reported.
- Monitor kernel logs for KASAN, double-free, xe_vm_bind_ioctl, GPU reset, or unexplained kernel-crash events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38731 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/77a946bf1af0e8110ef6e243394217a17f9b7e33CVE reference, Linux
- https://git.kernel.org/stable/c/111fb43a557726079a67ce3ab51f602ddbf7097eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.