In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix a fence leak in submit error path
In error paths, we could unref the submit without calling drmschedentitypushjob(), so msmjobfree() will never get called. Since drmschedjobcleanup() will NULL out the sfence, we can use that to detect this case.
Patchwork: https://patchwork.freedesktop.org/patch/653584/
[
{
"digest": {
"function_hash": "54066881941915179391542844535186425164",
"length": 686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eaa495b3d5710e5ba72051d2e01bb28292c625c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-12d04244"
},
{
"digest": {
"function_hash": "54066881941915179391542844535186425164",
"length": 686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2695b2f63bd77e0e03bc0fc779164115bb4699",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-1b872395"
},
{
"digest": {
"function_hash": "54066881941915179391542844535186425164",
"length": 686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc817f852e5f8ec8501d19ef7dcc01affa181d0",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-2ae3378d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"340076203923320422729197153583129380459",
"105629191805356813947624505058602451330",
"237236917308160172003398837631878800543"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@201eba5c9652a900c0b248070263f9acd3735689",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-361cbcf2"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"296075943704233058398949571414735689486",
"220769179481244530539320886862537215455",
"215720606442706904163612858145560642519"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5deab0fa6cfd0cd7def17598db15ceb84f950584",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-4b023d78"
},
{
"digest": {
"function_hash": "162075707901768349259709435799237299017",
"length": 581.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@201eba5c9652a900c0b248070263f9acd3735689",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-5e8554d7"
},
{
"digest": {
"function_hash": "54066881941915179391542844535186425164",
"length": 686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d319f75ccf7f0927425a7545aa1a22b3eedc189",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-65511d18"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"340076203923320422729197153583129380459",
"105629191805356813947624505058602451330",
"237236917308160172003398837631878800543"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dc817f852e5f8ec8501d19ef7dcc01affa181d0",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-69423c00"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"340076203923320422729197153583129380459",
"105629191805356813947624505058602451330",
"237236917308160172003398837631878800543"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d319f75ccf7f0927425a7545aa1a22b3eedc189",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-6ad2f57a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"340076203923320422729197153583129380459",
"105629191805356813947624505058602451330",
"237236917308160172003398837631878800543"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2695b2f63bd77e0e03bc0fc779164115bb4699",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-9c640b17"
},
{
"digest": {
"function_hash": "289586515964704908657321890355713476288",
"length": 708.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5deab0fa6cfd0cd7def17598db15ceb84f950584",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c",
"function": "__msm_gem_submit_destroy"
},
"id": "CVE-2025-38410-cc82a716"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"340076203923320422729197153583129380459",
"105629191805356813947624505058602451330",
"237236917308160172003398837631878800543"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eaa495b3d5710e5ba72051d2e01bb28292c625c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/msm/msm_gem_submit.c"
},
"id": "CVE-2025-38410-e91dd71b"
}
]