CVE-2025-39747

What it actually does

Unpatched krealloc failure in msm_ioctl_gem_info_set_metadata() allows NULL pointer dereference in the Linux kernel DRM MSM driver metadata setup path.

Why it matters to the business

Risk of kernel crashes or denial of service on affected Linux systems and containerized environments using MinimOS argocd components, with potential for privilege escalation in high-value container workloads.

How an attack unfolds

An attacker triggers the gem metadata ioctl under memory pressure to induce krealloc failure, dereferences the resulting NULL pointer, and leverages the resulting corruption for privilege escalation, consistent with VMSCAPE activity targeting Linux kernel container environments.

How to fix it

Upgrade argocd-fips-3.1, argocd-fips-3.1-repo-server and argocd-fips-3.1-compat to 3.1.0-r1; apply Linux kernel commit 53dc780c1e94ea782d8936b41bfaa83c663702eb or later stable equivalent.

How to confirm the fix worked

Confirm the presence of explicit krealloc failure check returning -ENOMEM in msm_ioctl_gem_info_set_metadata and absence of __GFP_NOFAIL usage.

Typical attack path

1. Identify systems running vulnerable Linux kernel or MinimOS argocd packages
2. Obtain sufficient permissions to invoke drm msm ioctls
3. Induce memory allocation pressure to force krealloc failure
4. Trigger msm_ioctl_gem_info_set_metadata to dereference NULL
5. Escalate privileges or crash the kernel

How to detect it

Search kernel logs and audit trails for oops/panic messages referencing msm_ioctl_gem_info_set_metadata or unexpected NULL dereferences during gem metadata operations; correlate with VMSCAPE TTPs on container-optimized hosts.

• msm_ioctl_gem_info_set_metadata
• krealloc.*-ENOMEM
• drm/msm.*metadata

What your security team should do

• Prioritize patching all MinimOS argocd and upstream Linux kernel instances to the listed fixed versions
• Monitor container workloads for kernel oops involving drm/msm functions
• Review and restrict unprivileged access to DRM ioctls where feasible
• Track VMSCAPE-related exploitation attempts against similar kernel flaws