PT-2025-33801 · Linux+1 · Linux Kernel+1

Published 2025-08-19 · Updated 2025-08-19 · CVE-2025-38603

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A slab-use-after-free issue was identified in the amdgpu user queue manager (amdgpu userq mgr fini()) within the kernel's DRM subsystem. The vulnerability occurs when memory is freed in amdgpu driver postclose kms() and subsequently accessed in amdgpu drm release(). This was reproduced on NV10 using the IGT pci unplug test, triggering a KASAN detected use-after-free condition. The fix involves moving the calls to amdgpu eviction fence destroy() and amdgpu userq mgr fini() into amdgpu driver postclose kms() to ensure they are invoked before the associated memory is freed, improving resource management consistency.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-38603

Affected Products

Linux Kernel

Amdgpu

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-38603 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38603 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38603 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38603 · Security Note
• https://git.kernel.org/linus/5fb90421fa0fbe0a968274912101fe917bf1c47b · Note
• https://git.kernel.org/stable/c/5fb90421fa0fbe0a968274912101fe917bf1c47b · Note
• https://twitter.com/CVEnew/status/1957854128069316648 · Twitter Post
• https://git.kernel.org/stable/c/f2997cef6d4056cb1b62190f1cf06e8dd19e228f · Note
• https://twitter.com/VulmonFeeds/status/1957943727239938402 · Twitter Post