{"id":"CVE-2025-38722","title":"habanalabs: fix UAF in export_dmabuf()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it.  That's fine for the case when a…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < d26058c2349d77d1ef179a2cc9752ca12004b6ff","Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < c07886761fd6251db6938d4e747002e3d150d231","Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 40deceb38f9db759772d1c289c28fd2a543f57fc","Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 55c232d7e0241f1d5120b595e7a9de24c75ed3d8","Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 33927f3d0ecdcff06326d6e4edb6166aed42811c","Linux 5.16"],"published":"2025-09-04","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:37:14.769Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38722","references":[{"url":"https://git.kernel.org/stable/c/d26058c2349d77d1ef179a2cc9752ca12004b6ff"},{"url":"https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"},{"url":"https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"},{"url":"https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"},{"url":"https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"}],"tags":["cve.org"],"epss":0.00196,"epssPercentile":0.09263,"ingestedAt":"2026-10-21T12:48:53.699Z","slug":"CVE-2025-38722","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it.  That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its ->release()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close.  In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of ->release() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up.  As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can't fail.\n\n## Affected\n\n- `Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < d26058c2349d77d1ef179a2cc9752ca12004b6ff`\n- `Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < c07886761fd6251db6938d4e747002e3d150d231`\n- `Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 40deceb38f9db759772d1c289c28fd2a543f57fc`\n- `Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 55c232d7e0241f1d5120b595e7a9de24c75ed3d8`\n- `Linux >= db1a8dd916aac986871f6b873a3aefad906f383a < 33927f3d0ecdcff06326d6e4edb6166aed42811c`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}