CVE-2025-38731
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
05/09/2025
Última modificación:
08/09/2025
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/xe: Fix vm_bind_ioctl double free bug<br />
<br />
If the argument check during an array bind fails, the bind_ops are freed<br />
twice as seen below. Fix this by setting bind_ops to NULL after freeing.<br />
<br />
==================================================================<br />
BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
Free of addr ffff88813bb9b800 by task xe_vm/14198<br />
<br />
CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full)<br />
Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021<br />
Call Trace:<br />
<br />
dump_stack_lvl+0x82/0xd0<br />
print_report+0xcb/0x610<br />
? __virt_addr_valid+0x19a/0x300<br />
? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
kasan_report_invalid_free+0xc8/0xf0<br />
? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
check_slab_allocation+0x102/0x130<br />
kfree+0x10d/0x440<br />
? should_fail_ex+0x57/0x2f0<br />
? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]<br />
? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]<br />
? __lock_acquire+0xab9/0x27f0<br />
? lock_acquire+0x165/0x300<br />
? drm_dev_enter+0x53/0xe0 [drm]<br />
? find_held_lock+0x2b/0x80<br />
? drm_dev_exit+0x30/0x50 [drm]<br />
? drm_ioctl_kernel+0x128/0x1c0 [drm]<br />
drm_ioctl_kernel+0x128/0x1c0 [drm]<br />
? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]<br />
? find_held_lock+0x2b/0x80<br />
? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]<br />
? should_fail_ex+0x57/0x2f0<br />
? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]<br />
drm_ioctl+0x352/0x620 [drm]<br />
? __pfx_drm_ioctl+0x10/0x10 [drm]<br />
? __pfx_rpm_resume+0x10/0x10<br />
? do_raw_spin_lock+0x11a/0x1b0<br />
? find_held_lock+0x2b/0x80<br />
? __pm_runtime_resume+0x61/0xc0<br />
? rcu_is_watching+0x20/0x50<br />
? trace_irq_enable.constprop.0+0xac/0xe0<br />
xe_drm_ioctl+0x91/0xc0 [xe]<br />
__x64_sys_ioctl+0xb2/0x100<br />
? rcu_is_watching+0x20/0x50<br />
do_syscall_64+0x68/0x2e0<br />
entry_SYSCALL_64_after_hwframe+0x76/0x7e<br />
RIP: 0033:0x7fa9acb24ded<br />
<br />
(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)