Answer in brief
CVE-2025-38703 records a Unknown severity vulnerability in drm/xe: Make dma-fences compliant with the safe access rules. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dd08ebf6c3525a7ea2186e636df064ea47281987 <b17fcce70733c211cb5dabf54f4f9491920b1d92 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <ba37807d08bae67de6139346a85650cab5f6145a || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <683b0e397dad9f26a42dcacf6f7f545a77ce6c06 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <6bd90e700b4285e6a7541e00f969cab0d696adde | b17fcce70733c211cb5dabf54f4f9491920b1d92, ba37807d08bae67de6139346a85650cab5f6145a, 683b0e397dad9f26a42dcacf6f7f545a77ce6c06, 6bd90e700b4285e6a7541e00f969cab0d696adde |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Sep 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-38703 records a Unknown severity vulnerability in drm/xe: Make dma-fences compliant with the safe access rules. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dd08ebf6c3525a7ea2186e636df064ea47281987 <b17fcce70733c211cb5dabf54f4f9491920b1d92 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <ba37807d08bae67de6139346a85650cab5f6145a || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <683b0e397dad9f26a42dcacf6f7f545a77ce6c06 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <6bd90e700b4285e6a7541e00f969cab0d696adde | b17fcce70733c211cb5dabf54f4f9491920b1d92, ba37807d08bae67de6139346a85650cab5f6145a, 683b0e397dad9f26a42dcacf6f7f545a77ce6c06, 6bd90e700b4285e6a7541e00f969cab0d696adde |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Sep 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock.
Quoted source text, attributed separately from HOL analysis.