CVE-2025-38355: Linux kernel · drm/xe: Process deferred GGTT node removals on device unwind
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in af2b588abe006bd55ddd358c4c3b87523349c475 : patch Linux kernel soon.
Data as of 5 Nov 2026, 21:33 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-05.
- Patch
- Available – fixed in af2b588abe006bd55ddd358c4c3b87523349c475, 5ab4eba9b26a93605b4f2f2b688d6ba818d7331d, 1b12f8dabbb8fd7d5a2611dd7bc5982ffbc2e5df
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.
What to do
Upgrade Linux kernel to af2b588abe006bd55ddd358c4c3b87523349c475, 5ab4eba9b26a93605b4f2f2b688d6ba818d7331d or 1b12f8dabbb8fd7d5a2611dd7bc5982ffbc2e5df.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix has been implemented and merged into the Linux kernel. Users should update to the fixed kernel version or apply the patch identified by commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391. No additional mitigation is required beyond applying the official fix.
Description
CVE-2025-38355 is a vulnerability in the Linux kernel's drm/xe driver related to deferred GGTT node removals during device unwind. The issue arises because asynchronous removal of GGTT nodes via a dedicated workqueue may occur after the MMIO/GMS mappings have been unmapped, leading to use-after-free conditions and kernel page faults. This was observed during unsuccessful virtual function initialization, causing kernel oops and supervisor write faults. The vulnerability has been fixed by explicitly draining the workqueue with all pending node removals before releasing MMIO/GSM mappings.