---
id: CVE-2025-38511
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe/pf: Clear all LMTT pages on alloc

  Our LMEM buffer objects are not cleared by default on alloc
  and during VF provisioning we only setup LMTT PTEs for the
  actuall…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe/pf: Clear all LMTT pages on alloc

  Our LMEM buffer objects are not cleared by default on alloc
  and during VF provisioning we only setup LMTT PTEs for the
  actuall…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.8, < 6.12.39'
  - 'linux_kernel >= 6.13, < 6.15.7'
  - linux_kernel = 6.16
patched:
  - linux_kernel 6.15.7
published: '2025-08-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:43.727'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38511'
references:
  - url: 'https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00161
epssPercentile: 0.05201
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:51:09.442377Z'
ingestedAt: '2026-10-15T22:48:25.510Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Clear all LMTT pages on alloc

Our LMEM buffer objects are not cleared by default on alloc
and during VF provisioning we only setup LMTT PTEs for the
actually provisioned LMEM range. But beyond that valid range
we might leave some stale data that could either point to some
other VFs allocations or even to the PF pages.

Explicitly clear all new LMTT page to avoid the risk that a
malicious VF would try to exploit that gap.

While around add asserts to catch any undesired PTE overwrites
and low-level debug traces to track LMTT PT life-cycle.

(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)

## Affected

- `linux_kernel >= 6.8, < 6.12.39`
- `linux_kernel >= 6.13, < 6.15.7`
- `linux_kernel = 6.16`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.7`