CVE-2025-38389

Q: What is the severity of CVE-2025-38389?

CVE-2025-38389 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's i915 graphics driver where a timeline reference is not properly released when VMA allocation fails during interrupted operations. This can lead to memory corruption and kernel crashes. Affects Linux systems with Intel integrated graphics using ring submission mode.

7.8 HIGH

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's i915 graphics driver where a timeline reference is not properly released when VMA allocation fails during interrupted operations. This can lead to memory corruption and kernel crashes. Affects Linux systems with Intel integrated graphics using ring submission mode.

💻 Affected Systems

Products:

Linux kernel with i915 graphics driver

Versions: Specific kernel versions with the vulnerable commit; check stable kernel trees for exact ranges

Operating Systems: Linux distributions with affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Intel integrated graphics using ring submission mode (older platforms). Execlists and GuC submission methods are not vulnerable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially allowing local privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, kernel warnings, and potential crashes during graphics-intensive operations or driver unloading.

🟢

If Mitigated

Minor performance impact during graphics operations with proper error handling.

🌐 Internet-Facing: LOW - Requires local access to trigger via specific IOCTL calls.

🏢 Internal Only: MEDIUM - Local users or processes with graphics access can trigger the issue, potentially causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger specific DRM_IOCTL_I915_GEM_EXECBUFFER2 calls with signal interruptions. Discovered through CI testing, not known to be actively exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f or backported fixes

Vendor Advisory: https://git.kernel.org/stable/c/40e09506aea1fde1f3e0e04eca531bbb23404baf

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable vulnerable tests

linux

Avoid running IGT tests that trigger the issue: igt@api_intel_allocator@fork-simple-stress-signal, igt@api_intel_allocator@two-level-inception-interruptible, igt@gem_linear_blits@interruptible, igt@prime_mmap_coherency@ioctl-errors

Use alternative submission methods

linux

Configure i915 driver to use execlists or GuC submission instead of ring submission if hardware supports it

echo options i915 enable_guc=2 > /etc/modprobe.d/i915.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict access to /dev/dri/card* devices to trusted users only
Monitor system logs for i915-related warnings and crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if i915 module is loaded with ring submission. Look for kernel warnings about 'i915_vma' or 'drm_WARN_ON' in dmesg.

Check Version:

uname -r && grep -i i915 /proc/modules

Verify Fix Applied:

Verify kernel version includes the fix commit. Test with vulnerable IGT tests if available.

📡 Detection & Monitoring

Log Indicators:

drm_WARN_ON(dev_priv->mm.shrink_count)
BUG i915_vma
Objects remaining on __kmem_cache_shutdown()
i915_gem_cleanup_early warnings

SIEM Query:

source="kernel" AND ("i915_vma" OR "drm_WARN_ON" OR "i915_gem_cleanup_early")

📊 Metadata

CVE ID: CVE-2025-38389

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.02% exploit probability (4.2th percentile)

Published: July 25, 2025

Last Updated: December 16, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable vulnerable tests

Use alternative submission methods

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export