{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38511", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-08-16T10:54:53.346Z", "dateUpdated": "2026-08-05T12:02:32.680Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:32.680Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Clear all LMTT pages on alloc\n\nOur LMEM buffer objects are not cleared by default on alloc\nand during VF provisioning we only setup LMTT PTEs for the\nactually provisioned LMEM range. But beyond that valid range\nwe might leave some stale data that could either point to some\nother VFs allocations or even to the PF pages.\n\nExplicitly clear all new LMTT page to avoid the risk that a\nmalicious VF would try to exploit that gap.\n\nWhile around add asserts to catch any undesired PTE overwrites\nand low-level debug traces to track LMTT PT life-cycle.\n\n(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires executing code on a system with an Xe SR-IOV Virtual Function assigned (a guest VM or container), driving GPU accesses to LMEM offsets above the provisioned quota via the VF's own GGTT/PPGTT entries. No network protocol is involved.\nAC:L - The gap is deterministic and present on every VF provisioning — no race, no timing window; with tens of thousands of uninitialized dwords and only a 1-bit validity check, thousands of usable rogue mappings are essentially guaranteed, and the VF can additionally groom VRAM with crafted PTE patterns before re-provisioning.\nPR:L - The attacker needs control of a VF (guest-side driver privileges to emit out-of-range LMEM offsets) but holds no privileges whatsoever on the host/PF that owns the vulnerable LMTT; relative to the vulnerable component this is a low, tenant-level authorization.\nUI:N - No victim action is required at exploit time — the VF simply accesses LMEM beyond its quota. PF-side SR-IOV provisioning is pre-existing administrative setup in any deployment where this code runs.\nS:C - The LMTT is the only hardware mechanism isolating a VF's local memory from the PF and other VFs, so bypassing it lets a guest reach memory belonging to the host and to other tenants — the DMA/IOMMU-boundary-bypass case, directly analogous to a guest-to-host escape.\nC:H - Stale valid PTEs map arbitrary 2 MiB-aligned pages across the device's entire local memory address space (32/128 GiB for 2L, 256 TiB for ML), letting the VF read PF driver allocations and other tenants' framebuffers and compute data.\nI:H - LMTT PTEs carry no read-only bit, so the VF also writes through the rogue mappings; landing on the LMTT PD/PT pages themselves yields deterministic arbitrary VRAM mapping, and landing on PF/other-VF PPGTT page-table BOs (allocated in VRAM on dGFX) lets the VF redirect another domain's GPU accesses, including to host system memory.\nA:H - Corrupting PF or peer-VF VRAM — GPU page tables, GuC context state and firmware images all live in local memory — causes GPU hangs, engine resets, wedged-device conditions and host driver failure, denying service to the host and every other tenant on the GPU." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_lmtt.c" ], "versions": [ { "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "lessThan": "ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8", "status": "affected", "versionType": "git" }, { "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "lessThan": "5d21892c2e15b6a27f8bc907693eca7c6b7cc269", "status": "affected", "versionType": "git" }, { "version": "b1d20405821812ad70d95eefe58cadc6d50b0917", "lessThan": "705a412a367f383430fa34bada387af2e52eb043", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_lmtt.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8" }, { "url": "https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269" }, { "url": "https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043" } ], "title": "drm/xe/pf: Clear all LMTT pages on alloc", "x_generator": { "engine": "bippy-1.2.0" } } } }