---
id: CVE-2025-38595
title: 'xen: fix UAF in dmabuf_exp_from_pages()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xen: fix UAF in dmabuf_exp_from_pages()

  [dma_buf_fd() fixes; no preferences regarding the tree it goes through -
  up to xen folks]

  As soon as we'd inserted a file refe…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    2be49867e68abbeb52d7f5d15eb1216154e2c0a0
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    ba8bc644f168509c16d48444991de7cfea3f12ec
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    e5907885260401bba300d4d18d79875c05b82651
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    3edfd2353f301bfffd5ee41066e37320a59ccc2d
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    d59d49af4aeed9a81e673e37c26c6a3bacf1a181
  - >-
    Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 <
    532c8b51b3a8676cbf533a291f8156774f30ea87
  - Linux 4.19
published: '2025-08-19'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:06.267Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38595'
references:
  - url: 'https://git.kernel.org/stable/c/2be49867e68abbeb52d7f5d15eb1216154e2c0a0'
  - url: 'https://git.kernel.org/stable/c/ba8bc644f168509c16d48444991de7cfea3f12ec'
  - url: 'https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651'
  - url: 'https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d'
  - url: 'https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181'
  - url: 'https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12128
ingestedAt: '2026-10-21T12:48:53.703Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xen: fix UAF in dmabuf_exp_from_pages()

[dma_buf_fd() fixes; no preferences regarding the tree it goes through -
up to xen folks]

As soon as we'd inserted a file reference into descriptor table, another
thread could close it.  That's fine for the case when all we are doing is
returning that descriptor to userland (it's a race, but it's a userland
race and there's nothing the kernel can do about it).  However, if we
follow fd_install() with any kind of access to objects that would be
destroyed on close (be it the struct file itself or anything destroyed
by its ->release()), we have a UAF.

dma_buf_fd() is a combination of reserving a descriptor and fd_install().
gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the
objects destroyed on close - starting with gntdev_dmabuf itself.

Fix that by doing reserving descriptor before anything else and do
fd_install() only when everything had been set up.

## Affected

- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < 2be49867e68abbeb52d7f5d15eb1216154e2c0a0`
- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < ba8bc644f168509c16d48444991de7cfea3f12ec`
- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < e5907885260401bba300d4d18d79875c05b82651`
- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < 3edfd2353f301bfffd5ee41066e37320a59ccc2d`
- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < d59d49af4aeed9a81e673e37c26c6a3bacf1a181`
- `Linux >= a240d6e42e28c34fdc34b3a98ca838a31c939901 < 532c8b51b3a8676cbf533a291f8156774f30ea87`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.