Linux kernel (drivers/gpu/drm/xe): Xe frees data that its exported dma-fences still point at - notably the timeline

CVSS 7.8CVE-2025-38703Kernel, userspace & hypervisorcurated

Impact

Xe frees data that its exported dma-fences still point at - notably the timeline name - as soon as the owning submit queue is closed. Because those fences can already have been handed to a different process as a sync_file fd, the holder reads freed kernel memory. One tenant closing a queue corrupts state observed by whoever it shared the fence with, which is a genuine cross-process use-after-free.

Who can reach it

A container with /dev/dri/renderD* on an Intel Xe node exports a fence (sync_file / syncobj / dma-buf) to another process, then destroys its exec queue; the receiving side's subsequent access to the fence hits freed memory. Both sides are unprivileged, and fence sharing across process boundaries is a normal, supported operation.

What to do

Update to a kernel with the fix commits below, which adds RCU grace periods before freeing fence-referenced data. Interim: do not pass fence/sync fds across tenant boundaries, and restrict render-node access.

References

https://git.kernel.org/stable/c/b17fcce70733c211cb5dabf54f4f9491920b1d92 https://git.kernel.org/stable/c/ba37807d08bae67de6139346a85650cab5f6145a https://nvd.nist.gov/vuln/detail/CVE-2025-38703

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.