CVE-2025-38511

drm/xe/pf: Clear all LMTT pages on alloc

State
Published
Severity
8.8 High
Published
Aug 16, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Clear all LMTT pages on alloc

Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages.

Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap.

While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.

(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b1d20405821812ad70d95eefe58cadc6d50b0917 to before ff4b8c9ade1b82979fdd01e6f45b60f92eed26d8Affected
  • b1d20405821812ad70d95eefe58cadc6d50b0917 to before 5d21892c2e15b6a27f8bc907693eca7c6b7cc269Affected
  • b1d20405821812ad70d95eefe58cadc6d50b0917 to before 705a412a367f383430fa34bada387af2e52eb043Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.39 through 6.12.*Not affected
  • 6.15.7 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.