Riskcovery

CVE-2025-38187

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

State
Published
Severity
7.8 High
Published
Jul 4, 2025
Updated
Oct 21, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

The RPC container is released after being passed to r535_gsp_rpc_send().

When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free.

Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent.

[ Rebase onto Blackwell changes. - Danilo ]

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 176fdcbddfd288408ce8571c1760ad618d962096 to before 69270d24af7694494ac4116bcad30a812ca49ca7Affected
  • 176fdcbddfd288408ce8571c1760ad618d962096 to before cd4677407c0ee250fc21e36439c8a442ddd62cc1Affected
  • 176fdcbddfd288408ce8571c1760ad618d962096 to before 9802f0a63b641f4cddb2139c814c2e95cb825099Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.15.4 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.