{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38598", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.028Z", "datePublished": "2025-08-19T17:03:33.308Z", "dateUpdated": "2026-07-30T05:55:37.762Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-30T05:55:37.762Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0\n\n[ +0.000020] BUG: KASAN: slab-use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu]\n[ +0.000817] Read of size 8 at addr ffff88812eec8c58 by task amd_pci_unplug/1733\n\n[ +0.000027] CPU: 10 UID: 0 PID: 1733 Comm: amd_pci_unplug Tainted: G W 6.14.0+ #2\n[ +0.000009] Tainted: [W]=WARN\n[ +0.000003] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[ +0.000004] Call Trace:\n[ +0.000004] \n[ +0.000003] dump_stack_lvl+0x76/0xa0\n[ +0.000011] print_report+0xce/0x600\n[ +0.000009] ? srso_return_thunk+0x5/0x5f\n[ +0.000006] ? kasan_complete_mode_report_info+0x76/0x200\n[ +0.000007] ? kasan_addr_to_slab+0xd/0xb0\n[ +0.000006] ? amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu]\n[ +0.000707] kasan_report+0xbe/0x110\n[ +0.000006] ? amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu]\n[ +0.000541] __asan_report_load8_noabort+0x14/0x30\n[ +0.000005] amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu]\n[ +0.000535] ? stop_cpsch+0x396/0x600 [amdgpu]\n[ +0.000556] ? stop_cpsch+0x429/0x600 [amdgpu]\n[ +0.000536] ? __pfx_amdgpu_userq_suspend+0x10/0x10 [amdgpu]\n[ +0.000536] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? kgd2kfd_suspend+0x132/0x1d0 [amdgpu]\n[ +0.000542] amdgpu_device_fini_hw+0x581/0xe90 [amdgpu]\n[ +0.000485] ? down_write+0xbb/0x140\n[ +0.000007] ? __mutex_unlock_slowpath.constprop.0+0x317/0x360\n[ +0.000005] ? __pfx_amdgpu_device_fini_hw+0x10/0x10 [amdgpu]\n[ +0.000482] ? __kasan_check_write+0x14/0x30\n[ +0.000004] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? up_write+0x55/0xb0\n[ +0.000007] ? srso_return_thunk+0x5/0x5f\n[ +0.000005] ? blocking_notifier_chain_unregister+0x6c/0xc0\n[ +0.000008] amdgpu_driver_unload_kms+0x69/0x90 [amdgpu]\n[ +0.000484] amdgpu_pci_remove+0x93/0x130 [amdgpu]\n[ +0.000482] pci_device_remove+0xae/0x1e0\n[ +0.000008] device_remove+0xc7/0x180\n[ +0.000008] device_release_driver_internal+0x3d4/0x5a0\n[ +0.000007] device_release_driver+0x12/0x20\n[ +0.000004] pci_stop_bus_device+0x104/0x150\n[ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40\n[ +0.000005] remove_store+0xd7/0xf0\n[ +0.000005] ? __pfx_remove_store+0x10/0x10\n[ +0.000006] ? __pfx__copy_from_iter+0x10/0x10\n[ +0.000006] ? __pfx_dev_attr_store+0x10/0x10\n[ +0.000006] dev_attr_store+0x3f/0x80\n[ +0.000006] sysfs_kf_write+0x125/0x1d0\n[ +0.000004] ? srso_return_thunk+0x5/0x5f\n[ +0.000005] ? __kasan_check_write+0x14/0x30\n[ +0.000005] kernfs_fop_write_iter+0x2ea/0x490\n[ +0.000005] ? rw_verify_area+0x70/0x420\n[ +0.000005] ? __pfx_kernfs_fop_write_iter+0x10/0x10\n[ +0.000006] vfs_write+0x90d/0xe70\n[ +0.000005] ? srso_return_thunk+0x5/0x5f\n[ +0.000005] ? __pfx_vfs_write+0x10/0x10\n[ +0.000004] ? local_clock+0x15/0x30\n[ +0.000008] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? __kasan_slab_free+0x5f/0x80\n[ +0.000005] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? __kasan_check_read+0x11/0x20\n[ +0.000004] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? fdget_pos+0x1d3/0x500\n[ +0.000007] ksys_write+0x119/0x220\n[ +0.000005] ? putname+0x1c/0x30\n[ +0.000006] ? __pfx_ksys_write+0x10/0x10\n[ +0.000007] __x64_sys_write+0x72/0xc0\n[ +0.000006] x64_sys_call+0x18ab/0x26f0\n[ +0.000006] do_syscall_64+0x7c/0x170\n[ +0.000004] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? __pfx___x64_sys_openat+0x10/0x10\n[ +0.000006] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? __kasan_check_read+0x11/0x20\n[ +0.000003] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? fpregs_assert_state_consistent+0x21/0xb0\n[ +0.000006] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? syscall_exit_to_user_mode+0x4e/0x240\n[ +0.000005] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? do_syscall_64+0x88/0x170\n[ +0.000003] ? srso_return_thunk+0x5/0x5f\n[ +0.000004] ? irqentry_exit+0x43/0x50\n[ +0.000004] ? srso_return_thunk+0x5\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" } } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c" ], "versions": [ { "version": "adba0929736a6a2d2780e8e6e4082e42e5ba025c", "lessThan": "96f663ae897b3e6ac17ced1d9b9c2ae9f165ad9a", "status": "affected", "versionType": "git" }, { "version": "adba0929736a6a2d2780e8e6e4082e42e5ba025c", "lessThan": "a886d26f2c8f9e3f3c1869ae368d09c75daac553", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/96f663ae897b3e6ac17ced1d9b9c2ae9f165ad9a" }, { "url": "https://git.kernel.org/stable/c/a886d26f2c8f9e3f3c1869ae368d09c75daac553" } ], "title": "drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0", "x_generator": { "engine": "bippy-1.2.0" } } } }