CVE-2025-38722

What it actually does

Use-after-free in habanalabs export_dmabuf() after dma_buf_fd() performs fd_install(); subsequent access to struct file or objects released by ->release() can occur because another thread may have closed the descriptor.

Why it matters to the business

Attackers with local access can trigger kernel memory corruption leading to crashes, privilege escalation, or container escape on affected systems; listed threat actors and rising EPSS indicate growing exploit interest despite low base score.

How an attack unfolds

Local attacker invokes habanalabs export_dmabuf(), races the newly installed file descriptor close from another thread, then accesses the freed struct file or dmabuf objects; VMSCAPE and related container-focused campaigns have targeted similar Linux kernel UAF primitives for privilege escalation.

How to fix it

Upgrade all listed MinimOS php-8.2 packages to 8.2.29-r0 or later; rebuild and restart any containers or services using habanalabs; apply kernel updates containing the fd_install ordering fix.

How to confirm the fix worked

Confirm package versions match 8.2.29-r0 or newer via package manager; verify kernel source contains the reordered dma_buf_fd() call before any post-install object access.

Typical attack path

1. Obtain local code execution on affected Linux system
2. Trigger habanalabs export_dmabuf() path while racing fd close
3. Access freed objects to corrupt kernel memory or leak pointers
4. Escalate to root or escape container

How to detect it

Review kernel logs for habanalabs UAF warnings or oops involving export_dmabuf and struct file; inspect auditd or syscall logs for unusual dma_buf_fd sequences followed by close; correlate with container breakout attempts by VMSCAPE or similar actors.

• habanalabs.*export_dmabuf
• dma_buf_fd.*UAF
• WARNING.*use-after-free.*struct file

What your security team should do

• Prioritize patching MinimOS php-8.2 packages to 8.2.29-r0 within 30 days given EPSS increase and listed threat actors
• Harden container runtime to limit habanalabs device access
• Enable kernel hardening features such as KASAN and lockdep in test environments
• Monitor for local privilege-escalation attempts involving habanalabs