CVE-2025-38594 — Use After Free in Linux

CWE-416 — Use After Free6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 94.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
LinuxLinux KernelDebian Linux+3 more
Timeline
PublishedAug 19

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") disables IOPF on device by removing the device from its IOMMU's IOPF queue when the last IOPF-capable domain is detached from the device. Unfortunately, it did this in a wrong place where there are still pending IOPFs. As a result, a use-after-free error is potentially triggered and eventually a ke…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5linux/linux17fce9d2336d952b95474248303e5e7d9777f2e0 — c68332b7ee893292bba6e87d31ef2080c066c65d+2

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2025-38594: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/v↗2025-08-19
▶
GHSA
GHSA-3p7j-wq4m-3p8j: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu↗2025-08-19
▶

📋Vendor Advisories

3
Red Hat
kernel: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs↗2025-08-19
▶
Debian
CVE-2025-38594: linux - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d:...↗2025
▶
Microsoft
net: stmmac: move the EST lock to struct stmmac_priv↗2024-06-11
▶
CVE-2025-38594 — Use After Free in Linux | cvebase