CVE-2025-38674

What it actually does

Incorrect dma_buf reference handling in DRM prime buffer sharing after a GEM object change, leading to potential reference counting errors or invalid memory access in the Linux kernel graphics subsystem.

Why it matters to the business

Local attackers could trigger graphics-related memory issues causing system instability, denial of service, or privilege escalation on affected Linux servers and workstations; urgency is low given minimal exploit activity and no ransomware usage.

How an attack unfolds

An attacker with local access performs graphics or buffer-sharing operations that invoke the flawed DRM prime code path, exploiting the reverted change to manipulate dma_buf references for memory corruption or unauthorized access.

How to fix it

Upgrade affected packages to the listed fixed versions: kgraft-patch-SLE12-SP1_Update_22 to 6-2.1 for SUSE Linux Enterprise Server variants, and Linux kernel to 6.15.9 or commit 5f05d83ce689a8930a70dfa73f879604aef8cc03 for GIT sources.

How to confirm the fix worked

Confirm the running kernel version matches a fixed release (6.15.9 or later, or the specified SUSE kgraft patch level) and verify the revert commit is present in the DRM prime source.

Typical attack path

1. Gain local user access on a vulnerable Linux system
2. Execute or trigger applications that perform DRM prime buffer operations
3. Abuse the dma_buf/GEM handling flaw to corrupt memory or escalate privileges

How to detect it

Inspect kernel logs for DRM or prime subsystem warnings and errors around buffer operations; monitor for unexpected graphics process terminations or memory faults on unpatched systems.

What your security team should do

• Prioritize kernel package updates on all affected systems within standard maintenance windows
• Limit unprivileged local access to graphics subsystems until patches are deployed
• Review graphics driver logs post-update for stability