CVE-2025-38722 (GCVE-0-2025-38722)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:33 – Updated: 2026-10-30 12:22
VLAI
Title
habanalabs: fix UAF in export_dmabuf()
Summary
In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). habanalabs export_dmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been". Fix that by reserving descriptor before anything else and do fd_install() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet; unlike dma_buf_fd(), fd_install() can't fail.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 5b0c23e9ec3e161a893d6ff9b4fad479e4539627 (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < d26058c2349d77d1ef179a2cc9752ca12004b6ff (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < c07886761fd6251db6938d4e747002e3d150d231 (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 40deceb38f9db759772d1c289c28fd2a543f57fc (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 55c232d7e0241f1d5120b595e7a9de24c75ed3d8 (git)
Affected: db1a8dd916aac986871f6b873a3aefad906f383a , < 33927f3d0ecdcff06326d6e4edb6166aed42811c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5b0c23e9ec3e161a893d6ff9b4fad479e4539627",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "d26058c2349d77d1ef179a2cc9752ca12004b6ff",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "c07886761fd6251db6938d4e747002e3d150d231",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close.  In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of -\u003erelease() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up.  As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can\u0027t fail."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM_IOCTL_HL_MEMORY ioctl (HL_MEM_OP_EXPORT_DMABUF_FD) on the local /dev/accel/accelN character device, requiring local system access. No network or physical vector is involved.\nAC:L - The attacker owns both sides of the race \u2014 one thread issues the export ioctl while a sibling thread spins on close() of the deterministically-numbered fd in the same process\u0027s fd table \u2014 and the ioctl can be retried indefinitely until the window is won. No condition depends on external state the attacker cannot influence.\nPR:L - The ioctl is registered with flags 0, so drm_ioctl_permit(), accel_open(), hl_device_open() and hl_mem_ioctl() perform no capability, root, or DRM-auth check; only an open fd on the accel node is required, which unprivileged compute users and containerized AI workloads normally have.\nUI:N - The attacking process triggers the race entirely on its own with two of its own threads. No victim action, mount, or file open is needed.\nS:U - The premature reference drops corrupt kernel objects (struct hl_ctx, struct file) within the same kernel security authority. No IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The use-after-free lets the attacker reclaim the freed hl_ctx/struct file slab objects with controlled content and have the kernel dereference them (ctx-\u003ehdev, ctx-\u003ehpriv-\u003efile_priv-\u003efilp), and the premature fput() on the accel device file yields a DirtyCred-style file UAF enabling arbitrary kernel memory disclosure.\nI:H - The exporting thread performs atomic refcount increments (hl_ctx_get, atomic_inc, get_file) through pointers read out of freed, attacker-reclaimable memory, giving a write primitive at an influenceable address; a dangling struct file reference is a well-established path to control-flow hijack and privilege escalation.\nA:H - Losing the race yields a NULL pointer dereference in memhash_node_export_put() (ctx is still NULL) or refcount underflow and use-after-free on the context and device file, causing an immediate kernel oops/panic that any local user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:22:16.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627"
        },
        {
          "url": "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"
        },
        {
          "url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"
        }
      ],
      "title": "habanalabs: fix UAF in export_dmabuf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38722",
    "datePublished": "2025-09-04T15:33:15.641Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-10-30T12:22:16.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38722",
      "date": "2026-11-13",
      "epss": "0.00205",
      "percentile": "0.10596"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-05T15:07:10.000Z",
      "cve": "CVE-2025-38722",
      "id": "msrc_CVE-2025-38722",
      "initial_release_date": "2025-09-06T01:11:57.000Z",
      "product_status:known_affected": "23",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "habanalabs: fix UAF in export_dmabuf()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38722.json",
      "version": "21"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accel/habanalabs/common/memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5b0c23e9ec3e161a893d6ff9b4fad479e4539627",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d26058c2349d77d1ef179a2cc9752ca12004b6ff",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c07886761fd6251db6938d4e747002e3d150d231",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c",
                    "status": "affected",
                    "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accel/habanalabs/common/memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.43",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37BFE2B2-793C-4855-98A2-693DB8914D33",
                    "versionEndExcluding": "6.12.43",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977",
                    "versionEndExcluding": "6.15.11",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899",
                    "versionEndExcluding": "6.16.2",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close.  In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of -\u003erelease() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up.  As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can\u0027t fail."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhabanalabs: corrige UAF en export_dmabuf()\n\nTan pronto como hubi\u00e9ramos insertado una referencia de archivo en la tabla de descriptores, otro hilo podr\u00eda cerrarla. Eso est\u00e1 bien para el caso en que todo lo que estamos haciendo es devolver ese descriptor al espacio de usuario (es una condici\u00f3n de carrera, pero es una condici\u00f3n de carrera del espacio de usuario y no hay nada que el kernel pueda hacer al respecto). Sin embargo, si despu\u00e9s de fd_install() seguimos con cualquier tipo de acceso a objetos que ser\u00edan destruidos al cerrar (ya sea la propia struct file o cualquier cosa destruida por su -\u003erelease()), tenemos un UAF.\n\ndma_buf_fd() es una combinaci\u00f3n de reservar un descriptor y fd_install(). habanalabs export_dmabuf() lo llama y luego procede a acceder a los objetos destruidos al cerrar. En particular, toma una referencia adicional a otra struct file que ser\u00e1 liberada como parte de -\u003erelease() para la nuestra; ese \u0027ser\u00e1\u0027 es en realidad \u0027podr\u00eda haber sido ya\u0027.\n\nCorregir eso reservando el descriptor antes que nada y haciendo fd_install() solo cuando todo hubiera sido configurado. Como beneficio adicional, ya no tenemos la salida por fallo con el archivo ya creado, pero la referencia al archivo subyacente (as\u00ed como -\u003edmabuf_export_cnt, etc.) a\u00fan no tomada; a diferencia de dma_buf_fd(), fd_install() no puede fallar."
          }
        ],
        "id": "CVE-2025-38722",
        "lastModified": "2026-10-30T13:18:07.790",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-04T16:15:41.993",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b0c23e9ec3e161a893d6ff9b4fad479e4539627"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-09T18:30:17+00:00",
      "cve": "CVE-2025-38722",
      "id": "CVE-2025-38722",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: habanalabs: fix UAF in export_dmabuf()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38722.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.