CVE-2025-38095

A flaw was found in the Linux kernel's dma-buf component. An issue with memory barrier usage (smp_store_mb()) can lead to memory update reordering. A local attacker could exploit this to cause a Null pointer dereference, resulting in a system crash (Denial of Service). This vulnerability may also lead to information disclosure or arbitrary code execution.

A flaw of moderate severity was found in the Linux kernel's dma-buf subsystem, affecting the Red Hat Enterprise Linux 9 and 10 kernels (including kernel-rt) and the Red Hat In-Vehicle OS 1.x kernel. The dma-buf fence-signaling code used smp_store_mb() to update the num_fences field. Because smp_store_mb() inserts the memory barrier after the store operation rather than before it, the intended ordering guarantee was not provided, and the memory update could be reordered. A local attacker could exploit this reordering to trigger a NULL pointer dereference, causing a kernel crash and resulting in denial of service. Red Hat Enterprise Linux 6, 7, and 8 are marked not affected because the vulnerable code is not present in those streams.

Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with local privileges and the verified consequence is limited to system availability. This differs from the CVE.org record, which scores the flaw 7.8 with high confidentiality and integrity impact; Red Hat's assessment found the demonstrated impact to be a NULL pointer dereference causing a system crash, with no evidence supporting information disclosure or arbitrary code execution.

The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams is deferred. Given the local attack vector, the privilege requirement, and the availability-only impact, the residual risk while the fix is deferred is limited to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.