Use-After-Free Vulnerability in Linux Kernel Affecting Xe Driver

CVE-2025-38703

What is CVE-2025-38703?

A vulnerability in the Xe driver of the Linux kernel allows for a use-after-free condition due to improper handling of dma-fences. When a user-space application closes the submit queue, the timeline name may be freed while still being referenced, potentially leading to undefined behavior on subsequent accesses. This flaw necessitates strict adherence to the newly defined dma-fence rules to ensure data integrity and system stability. Implementations must ensure a proper RCU grace period is maintained between fence signaling and freeing associated resources to mitigate this risk.

References