CVE-2025-38449

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: Acquire references on GEM handles for framebuffers

A GEM handle can be released while the GEM buffer object is attached

to a DRM framebuffer. This leads to the release of the dma-buf backing

the buffer object, if any. [1] Trying to use the framebuffer in further

mode-setting operations leads to a segmentation fault. Most easily

happens with driver that use shadow planes for vmap-ing the dma-buf

during a page flip. An example is shown below.

[ 156.791968] ------------[ cut here ]------------

[ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430

[...]

[ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430

[ 157.043420] Call Trace:

[ 157.045898] <TASK>

[ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0

[ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0

[ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0

[ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710

[ 157.065567] ? dma_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References