CVE-2025-38595

What it actually does

Use-after-free in xen dmabuf_exp_from_pages() after dma_buf_fd() performs fd_install(), allowing concurrent close to free gntdev_dmabuf and related objects before subsequent accesses.

Why it matters to the business

Kernel memory corruption risk in Xen-based virtualization environments can lead to crashes, privilege escalation, or container escapes on affected Linux systems; high downstream package prevalence increases exposure surface for cloud and container workloads.

How an attack unfolds

Attacker running in a guest or host context triggers dmabuf export while a second thread closes the freshly installed file descriptor, racing to access the now-freed gntdev_dmabuf structure; observed in campaigns by VMSCAPE and related container privilege-escalation chains.

How to fix it

Update Linux kernel to commit e5907885260401bba300d4d18d79875c05b82651 or later; for Chainguard packages upgrade openjdk-11-openj9 and related variants to 0.53.0-r0 or newer; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel git hash or package version matches fixed release; run targeted stress tests exercising gntdev dmabuf export under concurrent close; confirm absence of UAF reports in dmesg after patching.

Typical attack path

1. Obtain code execution or userland access inside a Xen guest or privileged container
2. Invoke gntdev dmabuf export path that calls dma_buf_fd() followed by object accesses
3. Race the fd close from another thread to trigger UAF on gntdev_dmabuf
4. Leverage freed memory for corruption or information leak to escalate privileges

How to detect it

Review kernel logs and dmesg for Xen gntdev or dmabuf related crashes or warnings; inspect audit logs for unusual dma-buf or file-descriptor activity around Xen grant devices; correlate with container runtime events on hosts using the vulnerable commit range.

• dmabuf_exp_from_pages
• gntdev_dmabuf
• dma_buf_fd

What your security team should do

• Immediately apply the listed kernel commit or Chainguard package upgrades due to 434 days since publication and observed threat actor interest
• Prioritize Xen and container hosts given VMSCAPE and related Linux kernel exploitation patterns
• Enable kernel hardening features such as KASAN and lockdep in test environments to surface similar races
• Monitor EPSS trend for continued increase and reassess if new exploit code appears