Executive brief
A vulnerability exists in the Linux kernel's Xen hypervisor interface that could allow a local attacker to crash the system or potentially gain unauthorized access to data. The issue occurs when the system handles shared memory buffers, creating a race condition where memory is accessed after it has been freed. This could lead to system instability or a complete service outage on affected Linux servers.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/xen/gntdev-dmabuf.c within the dmabuf_exp_from_pages() function. The root cause is a race condition where fd_install() is called before the kernel finishes accessing the associated gntdev_dmabuf object; if another thread closes the file descriptor immediately after installation, the object is destroyed while still in use. A local attacker with basic user privileges can exploit this race to trigger a kernel crash or potentially achieve privilege escalation. The fix reorders the operations to reserve the file descriptor first and only perform fd_install() after all object setup and references are complete. Patches are available in stable kernel versions 6.12.42, 6.15.10, and 6.16.1.
Affected products
- Linux Linux Kernel 4.19 to 6.12.41, 6.13 to 6.15.9, 6.16 to 6.16.0
Timeline
- 2025-07-12: other: Patch authored by Al Viro
- 2025-08-15: patched: Patches committed to stable trees
- 2025-08-19: disclosed: CVE-2025-38595 published