PT-2025-33796 · Linux+2 · Linux Kernel+2

CVE-2025-38598 · Publicado 2025-07-02 · Atualizado 2025-08-20

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A use-after-free issue exists in the amdgpu userq suspend function within the kernel's DRM/amdgpu subsystem. This can lead to a kernel bug as indicated by KASAN (Kernel Address Sanitizer) detecting a slab-use-after-free condition. The issue occurs during the amdgpu userq suspend process, specifically when reading memory at an address after it has been freed. The call trace indicates involvement of functions like amdgpu device fini hw, amdgpu driver unload kms, and pci device remove, suggesting a potential link to device removal or driver unloading.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2026-02827

CVE-2025-38598

Produtos afetados

Astra Linux

Linux Kernel

Amdgpu

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38598.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38598 · Aviso do Fabricante
• https://lore.kernel.org/linux-cve-announce/2025081919-CVE-2025-38598-4eab@gregkh · Nota
• https://git.kernel.org/linus/a886d26f2c8f9e3f3c1869ae368d09c75daac553 · Nota
• https://docs.bell-sw.com/security/cves/CVE-2025-38598 · Nota
• https://osv.dev/vulnerability/CVE-2025-38598 · Aviso do Fabricante
• https://git.kernel.org/stable/c/96f663ae897b3e6ac17ced1d9b9c2ae9f165ad9a · Correção
• https://twitter.com/CVEnew/status/1957854133387698364 · Publicação no Twitter
• https://osv.dev/vulnerability/BELL-CVE-2025-38598 · Aviso do Fabricante
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-38598 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-02827 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-38598 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-38598 · Nota de Segurança
• https://git.kernel.org/stable/c/a886d26f2c8f9e3f3c1869ae368d09c75daac553 · Correção