Linux kernel (drivers/gpu/drm): The dma_buf pointer cached on a GEM object goes stale the moment userspace drops the

Impact

The dma_buf pointer cached on a GEM object goes stale the moment userspace drops the last handle on that buffer, so a tenant that closes a handle at the right time while a PRIME export or import path is still walking the object gets the kernel to follow a dead pointer. The result is a kernel oops in shared DRM core code - code every driver on the node runs, not just one vendor's.

Who can reach it

A tenant container holding /dev/dri/renderD* drives it entirely with buffer-sharing ioctls: export a GEM object to a dma-buf fd, then release the last GEM handle while another thread is still operating on the shared buffer. No display access, no privileged capability, and the affected file is drm_prime.c in DRM core, so amdgpu, i915, xe, nouveau and virtio-gpu nodes are all in scope.

What to do

Update to a kernel containing the revert commits below. There is no useful interim control other than denying /dev/dri access to untrusted workloads, since PRIME buffer sharing is used by essentially every GPU client.

References

Related entries

• Linux kernel (drivers/gpu/drm): The shared GPU SVM layer mis-computes the mapping order when an HMM range onlyCVE-2025-40336 · Linux kernel (drivers/gpu/drm)High
• Linux kernel (drivers/gpu/drm): The shared shmem GEM mmap helper dropped a reference it never owned, so the bufferCVE-2022-48981 · Linux kernel (drivers/gpu/drm)High
• Linux kernel (drivers/gpu/drm): The shared VRAM buddy allocator reports success for a ranged allocation it neverCVE-2024-26911 · Linux kernel (drivers/gpu/drm)High
• Linux kernel (drivers/gpu/drm): DRM core stores a pointer to the caller's struct pid before taking a reference on itCVE-2024-39486 · Linux kernel (drivers/gpu/drm)High
• Linux kernel (drivers/gpu/drm): Three lines of userspace - mmap a GEM object with PROT_WRITE and MAP_PRIVATE, thenCVE-2024-39497 · Linux kernel (drivers/gpu/drm)Medium
• Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's bufferCVE-2025-38690 · Linux kernel (drivers/gpu/drm/xe)Medium