CVE-2025-37951 (GCVE-0-2025-37951)

Vulnerability from cvelistv5 – Published: 2025-05-20 16:01 – Updated: 2026-05-11 21:18
VLAI
Title
drm/v3d: Add job to pending list if the reset was skipped
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance to complete. However, when `timedout_job()` is called, the job in question is removed from the pending list, which means it won't be automatically freed through `free_job()`. Consequently, when we skip the reset and keep the job running, the job won't be freed when it finally completes. This situation leads to a memory leak, as exposed in [1] and [2]. Similarly to commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures the job is put back on the pending list when extending the timeout.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 57692c94dcbe99a1e0444409a3da13fb3443562c , < 5235b56b7e5449d990d21d78723b1a5e7bb5738e (git)
Affected: 57692c94dcbe99a1e0444409a3da13fb3443562c , < 12125f7d9c15e6d8ac91d10373b2db2f17dcf767 (git)
Affected: 57692c94dcbe99a1e0444409a3da13fb3443562c , < a5f162727b91e480656da1876247a91f651f76de (git)
Affected: 57692c94dcbe99a1e0444409a3da13fb3443562c , < 422a8b10ba42097a704d6909ada2956f880246f2 (git)
Affected: 57692c94dcbe99a1e0444409a3da13fb3443562c , < 35e4079bf1a2570abffce6ababa631afcf8ea0e5 (git)
Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 6.1.139 , ≤ 6.1.* (semver)
Unaffected: 6.6.91 , ≤ 6.6.* (semver)
Unaffected: 6.12.29 , ≤ 6.12.* (semver)
Unaffected: 6.14.7 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:41.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5235b56b7e5449d990d21d78723b1a5e7bb5738e",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "12125f7d9c15e6d8ac91d10373b2db2f17dcf767",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "a5f162727b91e480656da1876247a91f651f76de",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "422a8b10ba42097a704d6909ada2956f880246f2",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "35e4079bf1a2570abffce6ababa631afcf8ea0e5",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.139",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Add job to pending list if the reset was skipped\n\nWhen a CL/CSD job times out, we check if the GPU has made any progress\nsince the last timeout. If so, instead of resetting the hardware, we skip\nthe reset and let the timer get rearmed. This gives long-running jobs a\nchance to complete.\n\nHowever, when `timedout_job()` is called, the job in question is removed\nfrom the pending list, which means it won\u0027t be automatically freed through\n`free_job()`. Consequently, when we skip the reset and keep the job\nrunning, the job won\u0027t be freed when it finally completes.\n\nThis situation leads to a memory leak, as exposed in [1] and [2].\n\nSimilarly to commit 704d3d60fec4 (\"drm/etnaviv: don\u0027t block scheduler when\nGPU is still active\"), this patch ensures the job is put back on the\npending list when extending the timeout."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:18:15.521Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5235b56b7e5449d990d21d78723b1a5e7bb5738e"
        },
        {
          "url": "https://git.kernel.org/stable/c/12125f7d9c15e6d8ac91d10373b2db2f17dcf767"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f162727b91e480656da1876247a91f651f76de"
        },
        {
          "url": "https://git.kernel.org/stable/c/422a8b10ba42097a704d6909ada2956f880246f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e4079bf1a2570abffce6ababa631afcf8ea0e5"
        }
      ],
      "title": "drm/v3d: Add job to pending list if the reset was skipped",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37951",
    "datePublished": "2025-05-20T16:01:46.555Z",
    "dateReserved": "2025-04-16T04:51:23.973Z",
    "dateUpdated": "2026-05-11T21:18:15.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37951",
      "date": "2026-07-25",
      "epss": "0.00155",
      "percentile": "0.05087"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:54:15.000Z",
      "cve": "CVE-2025-37951",
      "id": "msrc_CVE-2025-37951",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/v3d: Add job to pending list if the reset was skipped",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37951.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37951\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:33.220\",\"lastModified\":\"2026-06-17T09:15:45.657\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Add job to pending list if the reset was skipped\\n\\nWhen a CL/CSD job times out, we check if the GPU has made any progress\\nsince the last timeout. If so, instead of resetting the hardware, we skip\\nthe reset and let the timer get rearmed. This gives long-running jobs a\\nchance to complete.\\n\\nHowever, when `timedout_job()` is called, the job in question is removed\\nfrom the pending list, which means it won\u0027t be automatically freed through\\n`free_job()`. Consequently, when we skip the reset and keep the job\\nrunning, the job won\u0027t be freed when it finally completes.\\n\\nThis situation leads to a memory leak, as exposed in [1] and [2].\\n\\nSimilarly to commit 704d3d60fec4 (\\\"drm/etnaviv: don\u0027t block scheduler when\\nGPU is still active\\\"), this patch ensures the job is put back on the\\npending list when extending the timeout.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Agregar trabajo a la lista de pendientes si se omiti\u00f3 el reinicio Cuando se agota el tiempo de espera de un trabajo CL/CSD, verificamos si la GPU ha progresado desde el \u00faltimo tiempo de espera. Si es as\u00ed, en lugar de reiniciar el hardware, omitimos el reinicio y dejamos que el temporizador se reactive. Esto les da a los trabajos de larga ejecuci\u00f3n la oportunidad de completarse. Sin embargo, cuando se llama a `timedout_job()`, el trabajo en cuesti\u00f3n se elimina de la lista de pendientes, lo que significa que no se liberar\u00e1 autom\u00e1ticamente a trav\u00e9s de `free_job()`. En consecuencia, cuando omitimos el reinicio y mantenemos el trabajo en ejecuci\u00f3n, el trabajo no se liberar\u00e1 cuando finalmente se complete. Esta situaci\u00f3n conduce a una fuga de memoria, como se expone en [1] y [2]. De manera similar a el commit 704d3d60fec4 (\\\"drm/etnaviv: no bloquee el programador cuando la GPU a\u00fan est\u00e9 activa\\\"), este parche garantiza que el trabajo se vuelva a colocar en la lista de pendientes al extender el tiempo de espera.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"57692c94dcbe99a1e0444409a3da13fb3443562c\",\"lessThan\":\"5235b56b7e5449d990d21d78723b1a5e7bb5738e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57692c94dcbe99a1e0444409a3da13fb3443562c\",\"lessThan\":\"12125f7d9c15e6d8ac91d10373b2db2f17dcf767\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57692c94dcbe99a1e0444409a3da13fb3443562c\",\"lessThan\":\"a5f162727b91e480656da1876247a91f651f76de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57692c94dcbe99a1e0444409a3da13fb3443562c\",\"lessThan\":\"422a8b10ba42097a704d6909ada2956f880246f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57692c94dcbe99a1e0444409a3da13fb3443562c\",\"lessThan\":\"35e4079bf1a2570abffce6ababa631afcf8ea0e5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.139\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.91\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.29\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.7\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"6.1.139\",\"matchCriteriaId\":\"C9A2466D-02D0-42D5-A978-9CAE4B4D5838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.91\",\"matchCriteriaId\":\"B6826C73-C5C9-430D-84C9-4045DFD72074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.29\",\"matchCriteriaId\":\"7215ABCF-8EB1-46CD-8872-8BCE4890E579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.7\",\"matchCriteriaId\":\"5715A6F5-A34A-4B27-8A64-82825E963995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12125f7d9c15e6d8ac91d10373b2db2f17dcf767\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/35e4079bf1a2570abffce6ababa631afcf8ea0e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/422a8b10ba42097a704d6909ada2956f880246f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5235b56b7e5449d990d21d78723b1a5e7bb5738e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5f162727b91e480656da1876247a91f651f76de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:17:33+00:00",
      "cve": "CVE-2025-37951",
      "id": "CVE-2025-37951",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/v3d: Add job to pending list if the reset was skipped",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37951.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.