PT-2025-33796 · Amd+2 · Amdgpu+2

Published 2025-07-02 · Updated 2025-08-19 · CVE-2025-38598

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A use-after-free issue exists in the amdgpu userq suspend function within the kernel's DRM/amdgpu subsystem. This can lead to a kernel bug as indicated by KASAN (Kernel Address Sanitizer) detecting a slab-use-after-free condition. The issue occurs during the amdgpu userq suspend process, specifically when reading memory at an address after it has been freed. The call trace indicates involvement of functions like amdgpu device fini hw, amdgpu driver unload kms, and pci device remove, suggesting a potential link to device removal or driver unloading.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-02827

CVE-2025-38598

Affected Products

Astra Linux

Linux Kernel

Amdgpu

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38598.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38598 · Vendor Advisory
• https://git.kernel.org/stable/c/a886d26f2c8f9e3f3c1869ae368d09c75daac553 · Patch
• https://cve.org/CVERecord?id=CVE-2025-38598 · Security Note
• https://bdu.fstec.ru/vul/2026-02827 · Security Note
• https://ubuntu.com/security/CVE-2025-38598 · Vendor Advisory
• https://git.kernel.org/stable/c/96f663ae897b3e6ac17ced1d9b9c2ae9f165ad9a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38598 · Security Note
• https://osv.dev/vulnerability/CVE-2025-38598 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2025081919-CVE-2025-38598-4eab@gregkh · Note
• https://twitter.com/CVEnew/status/1957854133387698364 · Twitter Post
• https://git.kernel.org/linus/a886d26f2c8f9e3f3c1869ae368d09c75daac553 · Note