PT-2025-29029 · Linux+1 · Linux Kernel+1

Anubis · Published 2025-05-14 · Updated 2025-11-18 · CVE-2025-38309

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains an issue within the drm/xe/vm subsystem. A flaw exists in the xe vm close and put() function where xe svm fini() can be called prematurely during virtual machine creation, specifically on error paths before the svm state is fully initialized. This can lead to system crashes (splats) and a non-recoverable NPD (Null Pointer Dereference) error.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-371

CWE-908

Related Identifiers

BDU:2025-09054

CVE-2025-38309

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38309.json · Exploit
• https://bdu.fstec.ru/vul/2025-09054 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-38309 · Vendor Advisory
• https://git.kernel.org/stable/c/8cf8cde41ad01150afbd1327ad1942387787f7fd · Patch
• https://git.kernel.org/stable/c/f5e6a6a8aa46d44ec7a240766cf3b7dd077718b9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38309 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38309 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38309 · Security Note
• https://ubuntu.com/security/CVE-2025-38309 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-38309 · Vendor Advisory
• https://vuldb.com/?id.315904 · Note
• https://twitter.com/CVEnew/status/1943297282331546098 · Twitter Post
• https://git.kernel.org/linus/8cf8cde41ad01150afbd1327ad1942387787f7fd · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://access.redhat.com/security/cve/cve-2025-38309 · Note