CVE-2025-38722
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38722
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38722.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38722
- Downstream
- Related
- Published
- 2025-09-04T15:33:15Z
- Modified
- 2025-10-18T06:29:45.638673Z
- Summary
- habanalabs: fix UAF in export_dmabuf()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
habanalabs: fix UAF in export_dmabuf()
As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF.
dmabuffd() is a combination of reserving a descriptor and fdinstall(). habanalabs exportdmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been".
Fix that by reserving descriptor before anything else and do fdinstall() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabufexportcnt, etc.) not grabbed yet; unlike dmabuffd(), fdinstall() can't fail.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c
- https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc
- https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8
- https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddb1a8dd916aac986871f6b873a3aefad906f383aFixedc07886761fd6251db6938d4e747002e3d150d231
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddb1a8dd916aac986871f6b873a3aefad906f383aFixed40deceb38f9db759772d1c289c28fd2a543f57fc
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddb1a8dd916aac986871f6b873a3aefad906f383aFixed55c232d7e0241f1d5120b595e7a9de24c75ed3d8
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceddb1a8dd916aac986871f6b873a3aefad906f383aFixed33927f3d0ecdcff06326d6e4edb6166aed42811c