CVE-2025-38189: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
drm/v3d: Avoid NULL pointer dereference in v3djobupdatestats()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1018.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Compensating control
In drm/v3d, update global GPU statistics but skip per-file-descriptor GPU statistics in v3d_job_update_stats() when the submitting file descriptor has already been closed, because its v3d_file_priv and stats have been freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38189?
CVE-2025-38189 has a medium severity level due to its potential to cause kernel crashes.
How do I fix CVE-2025-38189?
To fix CVE-2025-38189, update to the latest version of the Linux kernel that includes the patch for the vulnerability.
What impact does CVE-2025-38189 have on systems?
CVE-2025-38189 may lead to a NULL pointer dereference and result in unpredictable system behavior or crashes.
Which versions of the Linux kernel are affected by CVE-2025-38189?
CVE-2025-38189 affects multiple versions of the Linux kernel that include the vulnerable 'v3d_job_update_stats()' function.
Is CVE-2025-38189 exploitable remotely?
CVE-2025-38189 is primarily an internal issue that does not directly allow for remote exploitation.