Linux kernel (drivers/gpu/drm/nouveau): A buffer object imported over PRIME leaves a dangling pointer behind, and the

CVSS 7.8CVE-2025-37765Kernel, userspace & hypervisorcurated

Impact

A buffer object imported over PRIME leaves a dangling pointer behind, and the deferred TTM delete worker later walks it - the oops trace shows classic freed-slab poison being dereferenced. A tenant driving dma-buf import and release controls when the freed object is touched, turning it into a use-after-free in kernel worker context.

Who can reach it

A tenant process holding /dev/dri/renderD* on a nouveau GPU imports and releases dma-bufs in a loop; the fault lands asynchronously in the TTM delayed-delete workqueue, so it is not confined to the tenant's own task. Conditional on the node using the upstream nouveau driver.

What to do

Boot a kernel carrying the nouveau prime lifetime fix below. Interim: on nouveau nodes, withhold /dev/dri/renderD* from untrusted tenants, or forbid dma-buf import for workloads that do not need buffer sharing across devices.

References

https://git.kernel.org/stable/c/706868a1a1072cffd8bd63f7e161d79141099849 https://git.kernel.org/stable/c/47761deabb69a5df0c2c4ec400d80bb3e072bd2e https://nvd.nist.gov/vuln/detail/CVE-2025-37765

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.