Vulnerability-Lookup

GHSA-PF92-PQJF-2HMW

Vulnerability from github – Published: 2025-07-04 15:31 – Updated: 2025-11-19 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

The RPC container is released after being passed to r535_gsp_rpc_send().

When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free.

Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent.

[ Rebase onto Blackwell changes. - Danilo ]

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-04T14:15:25Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller\u0027s RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller\u0027s container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]",
  "id": "GHSA-pf92-pqjf-2hmw",
  "modified": "2025-11-19T21:31:14Z",
  "published": "2025-07-04T15:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38187"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38187 (GCVE-0-2025-38187)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00

Title

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free. Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent. [ Rebase onto Blackwell changes. - Danilo ]

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/cd4677407c0ee250f…
https://git.kernel.org/stable/c/9802f0a63b641f4cd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 176fdcbddfd288408ce8571c1760ad618d962096 , < cd4677407c0ee250fc21e36439c8a442ddd62cc1 (git) Affected: 176fdcbddfd288408ce8571c1760ad618d962096 , < 9802f0a63b641f4cddb2139c814c2e95cb825099 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd4677407c0ee250fc21e36439c8a442ddd62cc1",
              "status": "affected",
              "version": "176fdcbddfd288408ce8571c1760ad618d962096",
              "versionType": "git"
            },
            {
              "lessThan": "9802f0a63b641f4cddb2139c814c2e95cb825099",
              "status": "affected",
              "version": "176fdcbddfd288408ce8571c1760ad618d962096",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller\u0027s RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller\u0027s container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the nouveau GSP-RM RPC layer, reached through local GPU device operations and power-management transitions (DRM device open/close driving runtime PM, or system suspend/resume). There is no network or remote-peer input path to `r535_gsp_rpc_push()`.\nAC:L - The free and the subsequent use are sequential within the same thread, so no race must be won \u2014 every large RPC (any FBSR memlist over ~33 MB, which is the normal case on GSP GPUs) deterministically reads freed memory. Reallocation of the freed order-5/6 block by the immediately following `r535_gsp_rpc_get()` is likewise deterministic behaviour of the buddy allocator, and heap grooming from another CPU is fully under attacker control.\nPR:L - An unprivileged local user with access to the DRM render node can drive nouveau runtime-PM suspend/resume cycles (which invoke `r535_gsp_fini(suspend=true)` \u2192 `fbsr-\u003esuspend` \u2192 the large memlist RPC) simply by opening and closing the device; on typical desktop/laptop systems an active local session can also request system suspend via logind without elevated rights.\nUI:N - No victim action is needed \u2014 GPU runtime suspend fires automatically on idle and can be induced by the attacker\u0027s own process lifecycle, so the vulnerable path executes without any other user interacting with the system.\nS:U - The use-after-free and its consequences are contained within the kernel\u0027s own security authority; the corrupted DMA descriptors are consumed by the GPU within the driver\u0027s existing mappings rather than crossing a VM or IOMMU security boundary.\nC:H - Up to hundreds of kilobytes of freed kernel heap are read and transmitted verbatim to the GSP firmware as RPC continuation records, and because those bytes are interpreted as physical page descriptors for the VRAM save/restore DMA, a groomed heap lets an attacker steer GPU DMA reads at arbitrary memory.\nI:H - The stale data read from the freed container becomes the PTE array that GSP-RM uses as DMA targets for writing saved VRAM contents, so attacker-controlled reallocation of that buffer yields arbitrary physical-memory writes performed by the GPU; even without grooming the driver corrupts its own freshly allocated container through the overlapping memcpy.\nA:H - The use-after-free reliably corrupts the FBSR memlist sent to GSP-RM, producing firmware hangs, RPC timeouts, WARN/oops and failed resume that leave the GPU and often the machine unusable, and it trips KASAN/hardened-usercopy style fatal reports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:13.872Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"
        }
      ],
      "title": "drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38187",
    "datePublished": "2025-07-04T13:37:13.126Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:13.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-PF92-PQJF-2HMW

CVE-2025-38187 (GCVE-0-2025-38187)

Tags

Sightings

Nomenclature

Related by attack behaviour