CVE-2025-37951

What it actually does

Memory leak in drm/v3d driver: timedout_job() removes CL/CSD jobs from the pending list; when reset is skipped due to GPU progress the job is never re-added, so free_job() is never called and the job object leaks on completion.

Why it matters to the business

Long-running GPU workloads on V3D hardware can cause gradual kernel memory exhaustion, leading to degraded performance, OOM kills, or eventual system instability on affected Linux systems.

How an attack unfolds

An attacker with local access submits long-running CL or CSD jobs that repeatedly trigger the timeout path while GPU progress continues; each skipped reset leaks the job structure. Over time this depletes memory; listed threat actors have used similar kernel memory issues in privilege-escalation chains.

How to fix it

Upgrade the Linux kernel to a version containing commit 5235b56b7e5449d990d21d78723b1a5e7bb5738e (or later stable equivalent) in the drm/v3d driver.

How to confirm the fix worked

Confirm the running kernel contains commit 5235b56b7e5449d990d21d78723b1a5e7bb5738e; monitor kernel memory usage under sustained V3D workloads before and after the update to verify leak elimination.

Typical attack path

1. Obtain local unprivileged access on a system with V3D GPU
2. Submit CL/CSD jobs crafted to exceed the timeout threshold yet still make progress
3. Force repeated timeout handling without reset
4. Accumulate leaked job objects until memory pressure triggers OOM or DoS

How to detect it

Monitor kernel logs for v3d timeout messages combined with steadily rising slab or kmalloc memory usage; correlate with processes using the V3D DRM device; inspect for repeated timedout_job entries without corresponding job completion or reset logs.

What your security team should do

• Prioritize kernel upgrade on any system exposing V3D hardware to untrusted workloads
• Apply the fixed commit or distro backport within standard patch windows given low EPSS but persistent memory impact
• Add V3D job timeout and memory-leak monitoring to existing kernel telemetry