In the Linux kernel, the following vulnerability has been resolved:
drm/sched: Increment job count before swapping tail spsc queue
A small race exists between spscqueuepush and the run-job worker, in which spscqueuepush may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences.
Seal this race by incrementing the job count before appending to the SPSC queue.
This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case.
[
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8af39ec5cf2be522c8eb43a3d8005ed59e4daaee",
"id": "CVE-2025-38515-238f7749",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8af39ec5cf2be522c8eb43a3d8005ed59e4daaee",
"id": "CVE-2025-38515-79656223",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f51d0ec8a9baf324caf9a564f8e318d36a551",
"id": "CVE-2025-38515-7c6ed946",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a4f28a4fc4ee453a92a9abbe36e26224d17749",
"id": "CVE-2025-38515-7c97b8fc",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c64f5310530baf75328292f9b9f3f2961d185183",
"id": "CVE-2025-38515-867f0e6f",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef58a95457466849fa7b31fd3953801a5af0f58b",
"id": "CVE-2025-38515-8ae8e643",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0",
"id": "CVE-2025-38515-93c3a106",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d6547dc8b9b332f9bc00875197287a6a4db65a",
"id": "CVE-2025-38515-b3f4917b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef58a95457466849fa7b31fd3953801a5af0f58b",
"id": "CVE-2025-38515-b4d185f2",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0",
"id": "CVE-2025-38515-d4fa5e57",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2d6547dc8b9b332f9bc00875197287a6a4db65a",
"id": "CVE-2025-38515-dae8abe1",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "include/drm/spsc_queue.h",
"function": "spsc_queue_push"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e62f51d0ec8a9baf324caf9a564f8e318d36a551",
"id": "CVE-2025-38515-dff14f34",
"signature_version": "v1",
"digest": {
"function_hash": "136942352950027309541900265857330464358",
"length": 325.0
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9a4f28a4fc4ee453a92a9abbe36e26224d17749",
"id": "CVE-2025-38515-fe0a3980",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "include/drm/spsc_queue.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c64f5310530baf75328292f9b9f3f2961d185183",
"id": "CVE-2025-38515-febc4c76",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68118673229829496828540925333752338290",
"291103474912024608272506256309466446992",
"239745050404740135924133920574635857473",
"116235814791095945505006895994689885378",
"64301087207755819017145211208197556743",
"210070922053475913780171718479488583525"
]
}
}
]