CVE-2025-38187

What it actually does

Use-after-free occurs in r535_gsp_rpc_push() when the caller's RPC container is freed after the first fragment of a large RPC is sent to r535_gsp_rpc_send(), leaving subsequent fragment operations referencing freed memory in the nouveau DRM driver.

Why it matters to the business

Systems using the nouveau driver for NVIDIA GPUs may experience kernel instability, crashes, or potential local privilege escalation; the large number of downstream package dependents increases the blast radius for unpatched Linux distributions and container images.

How an attack unfolds

An attacker with local access crafts a workload that triggers a large multi-fragment RPC in the nouveau driver; the driver prematurely frees the container after the initial fragment, allowing the attacker to reuse the dangling pointer during remaining fragment transmission and corrupt kernel memory.

How to fix it

Update the Linux kernel to commit cd4677407c0ee250fc21e36439c8a442ddd62cc1 or later; for affected kyverno-policy-reporter packages upgrade to 3.1.4-r2 on both Chainguard and Wolfi repositories.

How to confirm the fix worked

Verify the running kernel contains commit cd4677407c0ee250fc21e36439c8a442ddd62cc1 or confirm package versions match the fixed releases; test nouveau RPC paths with large payloads to ensure no premature container release occurs.

Typical attack path

1. Obtain local code execution on a system using the nouveau DRM driver
2. Trigger a large RPC that exceeds the single-fragment size limit
3. Force the driver to allocate and then free the caller's container after the first fragment
4. Reuse the freed memory during subsequent fragment sends to corrupt kernel structures
5. Escalate to kernel code execution or cause denial of service

How to detect it

Review kernel logs for nouveau driver oops or use-after-free warnings around r535_gsp_rpc_push and r535_gsp_rpc_send; correlate with process activity that exercises DRM ioctl paths on systems with NVIDIA hardware.

What your security team should do

• Prioritize patching kernel and kyverno-policy-reporter packages within the next maintenance window due to the 480-day exposure window
• Restrict unprivileged local access on systems exposing the nouveau driver until patched
• Monitor EPSS trend and threat actor mentions for any increase in observed exploitation