PT-2025-25811 · Linux+4 · Linux Kernel+4

Published 2025-01-14 · Updated 2026-05-26 · CVE-2025-38036

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue occurs in the drm/xe/vf module, where VFs (Virtual Functions) need to communicate with the GuC (Graphics Unit Controller) to obtain the GMDID (Graphics Memory Device ID) value. However, due to recent refactoring, the GT (Graphics Technology) MMIO (Memory-Mapped Input/Output) members are initialized later, leading to a potential NPD (Non-Paged Data) crash when the VF attempts to use xe mmio read or xe mmio write functions from GuC functions. The crash is caused by an unset MMIO register address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

BDU:2025-08791

CVE-2025-38036

ECHO-8FD6-6A7B-45A8

USN-7769-1

USN-7769-2

USN-7769-3

USN-7770-1

USN-7771-1

USN-7789-1

USN-7789-2

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Ubuntu

References · 219

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38036.json · Exploit
• https://ubuntu.com/security/CVE-2025-38151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38038 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38099 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7771-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38037 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38306 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38311 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38040 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7769-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38032 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7769-1 · Vendor Advisory