Answer in brief
CVE-2025-38595 records a Unknown severity vulnerability in xen: fix UAF in dmabuf_exp_from_pages(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <e5907885260401bba300d4d18d79875c05b82651 || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <3edfd2353f301bfffd5ee41066e37320a59ccc2d || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <d59d49af4aeed9a81e673e37c26c6a3bacf1a181 || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <532c8b51b3a8676cbf533a291f8156774f30ea87 | e5907885260401bba300d4d18d79875c05b82651, 3edfd2353f301bfffd5ee41066e37320a59ccc2d, d59d49af4aeed9a81e673e37c26c6a3bacf1a181, 532c8b51b3a8676cbf533a291f8156774f30ea87 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
Aug 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-38595 records a Unknown severity vulnerability in xen: fix UAF in dmabuf_exp_from_pages(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <e5907885260401bba300d4d18d79875c05b82651 || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <3edfd2353f301bfffd5ee41066e37320a59ccc2d || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <d59d49af4aeed9a81e673e37c26c6a3bacf1a181 || >=a240d6e42e28c34fdc34b3a98ca838a31c939901 <532c8b51b3a8676cbf533a291f8156774f30ea87 | e5907885260401bba300d4d18d79875c05b82651, 3edfd2353f301bfffd5ee41066e37320a59ccc2d, d59d49af4aeed9a81e673e37c26c6a3bacf1a181, 532c8b51b3a8676cbf533a291f8156774f30ea87 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
Aug 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.
Quoted source text, attributed separately from HOL analysis.