Cloudanix VulnDB

CVE-2025-38673

None

CVSS

—

EPSS

0.1%

Published

Aug 22, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux kernel graphics component had a buffer handling mistake that was corrected by undoing a recent change, and systems should be updated to avoid related problems.

Exploitation
Other
Attacker needs
Other
Complexity
Other
Impact
Other
Component
OS kernel
Class
Other
Remediation
Other
Effort
Other
Patch risk
Other

What it actually does

The change reverts incorrect sourcing of dma_buf from a GEM object instance in the DRM framebuffer code, which could result in improper buffer lifetime management and potential memory reference errors in the Linux kernel graphics subsystem.

Why it matters to the business

Organizations running affected SUSE Linux Enterprise Server kernels or upstream Linux kernels may face graphics instability, crashes, or latent security exposure in display and rendering workloads, necessitating prompt patching to restore reliable operation across servers and endpoints.

How an attack unfolds

An attacker with local access could trigger graphics operations that exercise the flawed dma_buf handling path, attempting to induce memory corruption or unexpected behavior through crafted GEM framebuffer usage; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Apply the listed fixed versions: kgraft-patch-SLE12-SP2_Update_16 (SUSE Linux Enterprise Server for SAP Applications 12 SP2 and SUSE Linux Enterprise Server 12 SP2-LTSS) to 6-2.1; Linux kernel to 6.15.9 or the git commit e31f5a1c2cd38bf977736cdfa79444e19d4005ec.

How to confirm the fix worked

Confirm the installed kernel or kgraft package reports the fixed version string; inspect git history or package changelog for the presence of commit e31f5a1c2cd38bf977736cdfa79444e19d4005ec; retest graphics workloads for stability.

Typical attack path

  1. Enumerate target systems running vulnerable kernel versions
  2. Obtain local execution context
  3. Invoke DRM/GEM operations that reference framebuffers
  4. Attempt to manipulate buffer references to trigger corruption or denial of service

How to detect it

Review kernel logs and dmesg output for drm, gem, or framebuffer related errors or warnings on systems prior to patching; no specific post-exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates on all affected SUSE and Linux systems within standard change windows
  • Include the fixed versions in automated patch management baselines
  • Monitor vendor advisories for any follow-on regressions
  • Validate updates in non-production environments before broad deployment

The record

Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.15.0 6.15.9

Related vulnerabilities