CVE-2025-38511drm/xe/pf: Clear all LMTT pages on alloc
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from b1d20405821812ad70d95eefe58cadc6d50b0917 before ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8; from b1d20405821812ad70d95eefe58cadc6d50b0917 before 5d21892c2e15b6a27f8bc907693eca7c6b7cc269; from b1d20405821812ad70d95eefe58cadc6d50b0917 before 705a412a367f383430fa34bada387af2e52eb043 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.8 before 6.12.39; from 6.13 before 6.15.7; 6.16; 6.16; 6.16; 6.16; 6.16 | NVD |
References
- https://git.kernel.org/stable/c/ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8patch
- https://git.kernel.org/stable/c/5d21892c2e15b6a27f8bc907693eca7c6b7cc269patch
- https://git.kernel.org/stable/c/705a412a367f383430fa34bada387af2e52eb043patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.