CVE-2025-38515

Q: What is the severity of CVE-2025-38515?

CVE-2025-38515 has a CVSS score of 4.7 (MEDIUM). A race condition in the Linux kernel's DRM scheduler can cause job scheduling to stop, leading to system hangs when waiting on DMA fences. This affects systems using the Direct Rendering Manager (DRM) subsystem with vulnerable kernel versions, particularly those using the Xe driver. The vulnerability requires local access to trigger.

4.7 MEDIUM

📋 TL;DR

A race condition in the Linux kernel's DRM scheduler can cause job scheduling to stop, leading to system hangs when waiting on DMA fences. This affects systems using the Direct Rendering Manager (DRM) subsystem with vulnerable kernel versions, particularly those using the Xe driver. The vulnerability requires local access to trigger.

💻 Affected Systems

Products:

Linux kernel with DRM scheduler subsystem

Versions: Kernel versions containing the vulnerable code up to the fix commit

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Specifically affects systems using DRM drivers that utilize the scheduler, particularly the Xe driver as mentioned in the report. Requires DRM subsystem to be enabled and in use.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes unresponsive or hangs completely, requiring hard reboot and potentially causing data loss or service disruption.

🟠

Likely Case

Local denial of service affecting graphical applications or GPU-accelerated workloads, causing application crashes or system instability.

🟢

If Mitigated

Minimal impact with proper access controls limiting local user privileges and kernel hardening measures.

🌐 Internet-Facing: LOW - Requires local access to trigger, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes could cause denial of service affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering a specific race condition timing, which may be difficult to reliably achieve. Requires local access to the system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commit 549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0 or later

Vendor Advisory: https://git.kernel.org/stable/c/549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commit. 2. Check with your distribution for backported patches. 3. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Disable affected DRM drivers

Linux

If not using GPU acceleration or specific DRM drivers, they can be disabled via kernel parameters

Add 'modprobe.blacklist=drm' or specific driver blacklist to kernel boot parameters

🧯 If You Can't Patch

Restrict local user access and implement least privilege principles
Monitor system stability and implement automated recovery for hangs

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if DRM scheduler is active: 'uname -r' and 'lsmod | grep drm'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commit or is newer than vulnerable versions

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to DRM
System hang events in logs
GPU driver timeout messages

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for: 'kernel.*drm.*scheduler.*hang' OR 'kernel.*oops.*drm'

📊 Metadata

CVE ID: CVE-2025-38515

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: August 16, 2025

Last Updated: January 7, 2026

🔗 References

https://git.kernel.org/stable/c/549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0 Patch
https://git.kernel.org/stable/c/8af39ec5cf2be522c8eb43a3d8005ed59e4daaee Patch
https://git.kernel.org/stable/c/c64f5310530baf75328292f9b9f3f2961d185183 Patch
https://git.kernel.org/stable/c/e2d6547dc8b9b332f9bc00875197287a6a4db65a Patch
https://git.kernel.org/stable/c/e62f51d0ec8a9baf324caf9a564f8e318d36a551 Patch
https://git.kernel.org/stable/c/ef58a95457466849fa7b31fd3953801a5af0f58b Patch
https://git.kernel.org/stable/c/ef841f8e4e1ff67817ca899bedc5ebb00847c0a7 Patch
https://git.kernel.org/stable/c/f9a4f28a4fc4ee453a92a9abbe36e26224d17749 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory,Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory,Mailing List

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable affected DRM drivers

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export