CVE-2025-38703

What it actually does

The vulnerability allows use-after-free access to data pointed to by dma-fences, such as timeline names and shared locks, because the driver frees memory without ensuring an RCU grace period after signaling the fence.

Why it matters to the business

This can lead to system instability, crashes, or potential privilege escalation on Linux systems with Xe graphics drivers, especially in environments with containerized workloads or third-party fence usage.

How an attack unfolds

An attacker with access to the graphics subsystem can close a submit queue to free associated data while a dma-fence is still held by another process or sync_fence fd, leading to use-after-free when the fence is accessed.

How to fix it

Update the Linux kernel to a version containing commit b17fcce70733c211cb5dabf54f4f9491920b1d92 or later, ensuring RCU grace periods are respected for fence data freeing.

How to confirm the fix worked

Verify the kernel source includes the changes for making dma-fences compliant with safe access rules using RCU, and test fence export and queue closing scenarios.

Typical attack path

1. Identify or create a submit queue in the Xe driver
2. Export the dma-fence to a third party such as a sync_fence file descriptor
3. Close the submit queue to trigger freeing of timeline name or lock
4. Access the fence after the data has been freed to trigger the use-after-free

How to detect it

Look for kernel oops or crashes related to dma-fence access in logs, particularly involving Xe driver and freed timeline names.

What your security team should do

• Prioritize kernel updates on systems using Intel Xe graphics
• Monitor for kernel updates from stable repositories
• Review container and graphics driver configurations for exposure