CVE-2025-38595

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen: fix UAF in dmabuf_exp_from_pages()

[dma_buf_fd() fixes; no preferences regarding the tree it goes through -

up to xen folks]

As soon as we'd inserted a file reference into descriptor table, another

thread could close it. That's fine for the case when all we are doing is

returning that descriptor to userland (it's a race, but it's a userland

race and there's nothing the kernel can do about it). However, if we

follow fd_install() with any kind of access to objects that would be

destroyed on close (be it the struct file itself or anything destroyed

by its ->release()), we have a UAF.

dma_buf_fd() is a combination of reserving a descriptor and fd_install().

gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the

objects destroyed on close - starting with gntdev_dmabuf itself.

Fix that by doing reserving descriptor before anything else and do

fd_install() only when everything had been set up.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References