In the Linux kernel, the following vulnerability has been resolved:
drm/sched: Increment job count before swapping tail spsc queue
A small race exists between spscqueuepush and the run-job worker, in which spscqueuepush may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences.
Seal this race by incrementing the job count before appending to the SPSC queue.
This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case.
[
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8af39ec5cf2be522c8eb43a3d8005ed59e4daaee",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-238f7749",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8af39ec5cf2be522c8eb43a3d8005ed59e4daaee",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-79656223",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f51d0ec8a9baf324caf9a564f8e318d36a551",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-7c6ed946",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a4f28a4fc4ee453a92a9abbe36e26224d17749",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-7c97b8fc",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c64f5310530baf75328292f9b9f3f2961d185183",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-867f0e6f",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef58a95457466849fa7b31fd3953801a5af0f58b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-8ae8e643",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-93c3a106",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d6547dc8b9b332f9bc00875197287a6a4db65a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-b3f4917b",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef58a95457466849fa7b31fd3953801a5af0f58b",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-b4d185f2",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-d4fa5e57",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d6547dc8b9b332f9bc00875197287a6a4db65a",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-dae8abe1",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "function": "spsc_queue_push",
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f51d0ec8a9baf324caf9a564f8e318d36a551",
        "digest": {
            "function_hash": "136942352950027309541900265857330464358",
            "length": 325.0
        },
        "id": "CVE-2025-38515-dff14f34",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a4f28a4fc4ee453a92a9abbe36e26224d17749",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-fe0a3980",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "target": {
            "file": "include/drm/spsc_queue.h"
        },
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c64f5310530baf75328292f9b9f3f2961d185183",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68118673229829496828540925333752338290",
                "291103474912024608272506256309466446992",
                "239745050404740135924133920574635857473",
                "116235814791095945505006895994689885378",
                "64301087207755819017145211208197556743",
                "210070922053475913780171718479488583525"
            ]
        },
        "id": "CVE-2025-38515-febc4c76",
        "signature_version": "v1"
    }
]