CVE-2025-38731: drm/xe: Fix vm_bind_ioctl double free bug
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix vmbindioctl double free bug
If the argument check during an array bind fails, the bindops are freed twice as seen below. Fix this by setting bindops to NULL after freeing.
================================================================== BUG: KASAN: double-free in xevmbindioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xevm/14198
CPU: 5 UID: 0 PID: 14198 Comm: xevm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dumpstacklvl+0x82/0xd0 printreport+0xcb/0x610 ? virtaddrvalid+0x19a/0x300 ? xevmbindioctl+0x1b2/0x21f0 [xe] kasanreportinvalidfree+0xc8/0xf0 ? xevmbindioctl+0x1b2/0x21f0 [xe] ? xevmbindioctl+0x1b2/0x21f0 [xe] checkslaballocation+0x102/0x130 kfree+0x10d/0x440 ? shouldfailex+0x57/0x2f0 ? xevmbindioctl+0x1b2/0x21f0 [xe] xevmbindioctl+0x1b2/0x21f0 [xe] ? pfxxevmbindioctl+0x10/0x10 [xe] ? lockacquire+0xab9/0x27f0 ? lockacquire+0x165/0x300 ? drmdeventer+0x53/0xe0 [drm] ? findheldlock+0x2b/0x80 ? drmdevexit+0x30/0x50 [drm] ? drmioctlkernel+0x128/0x1c0 [drm] drmioctlkernel+0x128/0x1c0 [drm] ? pfxxevmbindioctl+0x10/0x10 [xe] ? findheldlock+0x2b/0x80 ? pfxdrmioctlkernel+0x10/0x10 [drm] ? shouldfailex+0x57/0x2f0 ? pfxxevmbindioctl+0x10/0x10 [xe] drmioctl+0x352/0x620 [drm] ? pfxdrmioctl+0x10/0x10 [drm] ? pfxrpmresume+0x10/0x10 ? dorawspinlock+0x11a/0x1b0 ? findheldlock+0x2b/0x80 ? pmruntimeresume+0x61/0xc0 ? rcuiswatching+0x20/0x50 ? traceirqenable.constprop.0+0xac/0xe0 xedrmioctl+0x91/0xc0 [xe] x64sysioctl+0xb2/0x100 ? rcuiswatching+0x20/0x50 dosyscall64+0x68/0x2e0 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded
(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix vmbindioctl double free bug
If the argument check during an array bind fails, the bindops are freed twice as seen below. Fix this by setting bindops to NULL after freeing.
================================================================== BUG: KASAN: double-free in xevmbindioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xevm/14198
CPU: 5 UID: 0 PID: 14198 Comm: xevm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: TASK dumpstacklvl+0x82/0xd0 printreport+0xcb/0x610 ? virtaddrvalid+0x19a/0x300 ? xevmbindioctl+0x1b2/0x21f0 [xe] kasanreportinvalidfree+0xc8/0xf0 ? xevmbindioctl+0x1b2/0x21f0 [xe] ? xevmbindioctl+0x1b2/0x21f0 [xe] checkslaballocation+0x102/0x130 kfree+0x10d/0x440 ? shouldfailex+0x57/0x2f0 ? xevmbindioctl+0x1b2/0x21f0 [xe] xevmbindioctl+0x1b2/0x21f0 [xe] ? pfxxevmbindioctl+0x10/0x10 [xe] ? lockacquire+0xab9/0x27f0 ? lockacquire+0x165/0x300 ? drmdeventer+0x53/0xe0 [drm] ? findheldlock+0x2b/0x80 ? drmdevexit+0x30/0x50 [drm] ? drmioctlkernel+0x128/0x1c0 [drm] drmioctlkernel+0x128/0x1c0 [drm] ? pfxxevmbindioctl+0x10/0x10 [xe] ? findheldlock+0x2b/0x80 ? pfxdrmioctlkernel+0x10/0x10 [drm] ? shouldfailex+0x57/0x2f0 ? pfxxevmbindioctl+0x10/0x10 [xe] drmioctl+0x352/0x620 [drm] ? pfxdrmioctl+0x10/0x10 [drm] ? pfxrpmresume+0x10/0x10 ? dorawspinlock+0x11a/0x1b0 ? findheldlock+0x2b/0x80 ? pmruntimeresume+0x61/0xc0 ? rcuiswatching+0x20/0x50 ? traceirqenable.constprop.0+0xac/0xe0 xedrmioctl+0x91/0xc0 [xe] x64sysioctl+0xb2/0x100 ? rcuiswatching+0x20/0x50 dosyscall64+0x68/0x2e0 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded
(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In xe_vm_bind_ioctl, after freeing bind_ops, set bind_ops to NULL to prevent a double-free when the bind_ops allocation is freed due to an array bind argument check failure.
drm/xe xe_vm_bind_ioctl (xe) bind_ops = NULL after freeing
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38731?
CVE-2025-38731 is categorized as a medium-severity vulnerability due to the potential for a double free bug in the Linux kernel.
How do I fix CVE-2025-38731?
To mitigate CVE-2025-38731, ensure that your Linux kernel is updated to include the patches that resolve the double free issue.
What is the impact of CVE-2025-38731?
The impact of CVE-2025-38731 may include system instability or crashes resulting from improperly managed memory in the kernel.
Which versions of the Linux kernel are affected by CVE-2025-38731?
CVE-2025-38731 affects specific versions of the Linux kernel before the fix was implemented, but exact versions may vary based on distribution.
What should I do if I'm using an affected version of the Linux kernel for CVE-2025-38731?
If you're using an affected version of the Linux kernel for CVE-2025-38731, it is recommended to update your kernel to the latest stable version immediately.