Answer in brief
CVE-2025-38703 records a High severity (CVSS 7.8) vulnerability in drm/xe: Make dma-fences compliant with the safe access rules. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dd08ebf6c3525a7ea2186e636df064ea47281987 <b17fcce70733c211cb5dabf54f4f9491920b1d92 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <ba37807d08bae67de6139346a85650cab5f6145a || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <683b0e397dad9f26a42dcacf6f7f545a77ce6c06 || >=dd08ebf6c3525a7ea2186e636df064ea47281987 <6bd90e700b4285e6a7541e00f969cab0d696adde | b17fcce70733c211cb5dabf54f4f9491920b1d92, ba37807d08bae67de6139346a85650cab5f6145a, 683b0e397dad9f26a42dcacf6f7f545a77ce6c06, 6bd90e700b4285e6a7541e00f969cab0d696adde |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Sep 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock.
Quoted source text, attributed separately from HOL analysis.