CVE-2025-38731

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix vmbindioctl double free bug

If the argument check during an array bind fails, the bindops are freed twice as seen below. Fix this by setting bindops to NULL after freeing.

================================================================== BUG: KASAN: double-free in xevmbindioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xevm/14198

CPU: 5 UID: 0 PID: 14198 Comm: xevm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dumpstacklvl+0x82/0xd0 printreport+0xcb/0x610 ? _virtaddrvalid+0x19a/0x300 ? xevmbindioctl+0x1b2/0x21f0 [xe] kasanreportinvalidfree+0xc8/0xf0 ? xevmbindioctl+0x1b2/0x21f0 [xe] ? xevmbindioctl+0x1b2/0x21f0 [xe] checkslaballocation+0x102/0x130 kfree+0x10d/0x440 ? shouldfailex+0x57/0x2f0 ? xevmbindioctl+0x1b2/0x21f0 [xe] xevmbindioctl+0x1b2/0x21f0 [xe] ? _pfxxevmbindioctl+0x10/0x10 [xe] ? _lockacquire+0xab9/0x27f0 ? lockacquire+0x165/0x300 ? drmdeventer+0x53/0xe0 [drm] ? findheldlock+0x2b/0x80 ? drmdevexit+0x30/0x50 [drm] ? drmioctlkernel+0x128/0x1c0 [drm] drmioctlkernel+0x128/0x1c0 [drm] ? _pfxxevmbindioctl+0x10/0x10 [xe] ? findheldlock+0x2b/0x80 ? _pfxdrmioctlkernel+0x10/0x10 [drm] ? shouldfailex+0x57/0x2f0 ? _pfxxevmbindioctl+0x10/0x10 [xe] drmioctl+0x352/0x620 [drm] ? _pfxdrmioctl+0x10/0x10 [drm] ? _pfxrpmresume+0x10/0x10 ? dorawspinlock+0x11a/0x1b0 ? findheldlock+0x2b/0x80 ? _pmruntimeresume+0x61/0xc0 ? rcuiswatching+0x20/0x50 ? traceirqenable.constprop.0+0xac/0xe0 xedrmioctl+0x91/0xc0 [xe] _x64sysioctl+0xb2/0x100 ? rcuiswatching+0x20/0x50 dosyscall64+0x68/0x2e0 entrySYSCALL64after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded

(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)