CVE-2025-38672

What it actually does

The flaw stems from a prior change in drm/gem-dma that altered DMA buffer sourcing from GEM objects, introducing reference-counting or lifetime management errors that can result in use-after-free or invalid memory access in the Linux kernel graphics subsystem.

Why it matters to the business

Affected Linux systems may experience kernel instability, crashes, or limited privilege escalation opportunities, disrupting server workloads and graphics-dependent services across widely deployed enterprise distributions.

How an attack unfolds

An attacker with local access crafts a sequence of graphics or DMA operations that exercise the flawed GEM-to-dma_buf path; the incorrect object lifetime handling leads to a dangling reference that can be leveraged for memory corruption.

How to fix it

Upgrade to the listed fixed versions: kgraft-patch-SLE12-SP2_Update_17 (SUSE Linux Enterprise Server for SAP Applications 12 SP2 and 12 SP2-LTSS) to 6-2.1; mainline kernel to 6.15.9 or commit e7bdb3104a2f71ec1439d37f8e6e2f201dbcd7cf. Reboot after patching and verify the revert is present.

How to confirm the fix worked

Confirm the running kernel contains the revert commit or matches a fixed version string; inspect /proc/version or dmesg output for the corrected drm/gem-dma behavior and run regression tests on DMA buffer paths.

Typical attack path

1. Enumerate kernel version and confirm presence of the vulnerable drm/gem-dma commit
2. Obtain local unprivileged access on the target system
3. Trigger DRM/GEM operations that allocate and release dma_buf objects
4. Exploit resulting use-after-free or reference error for memory corruption or code execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for drm, gem, or dma_buf related warnings, oops, or use-after-free traces around the time of the original commit; correlate with process activity involving graphics or video drivers.

What your security team should do

• Prioritize patching all affected SUSE and mainline kernel instances to the specified fixed versions
• Monitor EPSS and exploit maturity indicators for any future increase in risk
• Apply defense-in-depth controls such as kernel lockdown and restricted graphics device access until patches are deployed