CVE-2025-38722

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

habanalabs: fix UAF in export_dmabuf()

As soon as we'd inserted a file reference into descriptor table, another

thread could close it. That's fine for the case when all we are doing is

returning that descriptor to userland (it's a race, but it's a userland

race and there's nothing the kernel can do about it). However, if we

follow fd_install() with any kind of access to objects that would be

destroyed on close (be it the struct file itself or anything destroyed

by its ->release()), we have a UAF.

dma_buf_fd() is a combination of reserving a descriptor and fd_install().

habanalabs export_dmabuf() calls it and then proceeds to access the

objects destroyed on close. In particular, it grabs an extra reference to

another struct file that will be dropped as part of ->release() for ours;

that "will be" is actually "might have already been".

Fix that by reserving descriptor before anything else and do fd_install()

only

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References