Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-37754— drm/i915/huc: Fix fence not released on early probe errors

AI Predicted 5.5 Difficulty: Moderate EPSS 0.20% · P10

Affected Version Matrix 12

VendorProductVersion RangeStatus
LinuxLinux27536e03271da3dafcdddf735102041a26ad5bd0< 9f5ef4a5eaa61a7a4ed31231da45deb85065397aaffected
27536e03271da3dafcdddf735102041a26ad5bd0< c5a906806162aea62dbe5d327760ce3b7117ca17affected
27536e03271da3dafcdddf735102041a26ad5bd0< 4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00affected
27536e03271da3dafcdddf735102041a26ad5bd0< f104ef4db9f8f3923cc06ed1fafb3da38df6006daffected
27536e03271da3dafcdddf735102041a26ad5bd0< e3ea2eae70692a455e256787e4f54153fb739b90affected
6.2affected
< 6.2unaffected
6.6.88≤ 6.6.*unaffected
… +4 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-37754

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/i915/huc: Fix fence not released on early probe errors
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915/huc: Fix fence not released on early probe errors HuC delayed loading fence, introduced with commit 27536e03271da ("drm/i915/huc: track delayed HuC load with a fence"), is registered with object tracker early on driver probe but unregistered only from driver remove, which is not called on early probe errors. Since its memory is allocated under devres, then released anyway, it may happen to be allocated again to the fence and reused on future driver probes, resulting in kernel warnings that taint the kernel: <4> [309.731371] ------------[ cut here ]------------ <3> [309.731373] ODEBUG: init destroyed (active state 0) object: ffff88813d7dd2e0 object type: i915_sw_fence hint: sw_fence_dummy_notify+0x0/0x20 [i915] <4> [309.731575] WARNING: CPU: 2 PID: 3161 at lib/debugobjects.c:612 debug_print_object+0x93/0xf0 ... <4> [309.731693] CPU: 2 UID: 0 PID: 3161 Comm: i915_module_loa Tainted: G U 6.14.0-CI_DRM_16362-gf0fd77956987+ #1 ... <4> [309.731700] RIP: 0010:debug_print_object+0x93/0xf0 ... <4> [309.731728] Call Trace: <4> [309.731730] <TASK> ... <4> [309.731949] __debug_object_init+0x17b/0x1c0 <4> [309.731957] debug_object_init+0x34/0x50 <4> [309.732126] __i915_sw_fence_init+0x34/0x60 [i915] <4> [309.732256] intel_huc_init_early+0x4b/0x1d0 [i915] <4> [309.732468] intel_uc_init_early+0x61/0x680 [i915] <4> [309.732667] intel_gt_common_init_early+0x105/0x130 [i915] <4> [309.732804] intel_root_gt_init_early+0x63/0x80 [i915] <4> [309.732938] i915_driver_probe+0x1fa/0xeb0 [i915] <4> [309.733075] i915_pci_probe+0xe6/0x220 [i915] <4> [309.733198] local_pci_probe+0x44/0xb0 <4> [309.733203] pci_device_probe+0xf4/0x270 <4> [309.733209] really_probe+0xee/0x3c0 <4> [309.733215] __driver_probe_device+0x8c/0x180 <4> [309.733219] driver_probe_device+0x24/0xd0 <4> [309.733223] __driver_attach+0x10f/0x220 <4> [309.733230] bus_for_each_dev+0x7d/0xe0 <4> [309.733236] driver_attach+0x1e/0x30 <4> [309.733239] bus_add_driver+0x151/0x290 <4> [309.733244] driver_register+0x5e/0x130 <4> [309.733247] __pci_register_driver+0x7d/0x90 <4> [309.733251] i915_pci_register_driver+0x23/0x30 [i915] <4> [309.733413] i915_init+0x34/0x120 [i915] <4> [309.733655] do_one_initcall+0x62/0x3f0 <4> [309.733667] do_init_module+0x97/0x2a0 <4> [309.733671] load_module+0x25ff/0x2890 <4> [309.733688] init_module_from_file+0x97/0xe0 <4> [309.733701] idempotent_init_module+0x118/0x330 <4> [309.733711] __x64_sys_finit_module+0x77/0x100 <4> [309.733715] x64_sys_call+0x1f37/0x2650 <4> [309.733719] do_syscall_64+0x91/0x180 <4> [309.733763] entry_SYSCALL_64_after_hwframe+0x76/0x7e <4> [309.733792] </TASK> ... <4> [309.733806] ---[ end trace 0000000000000000 ]--- That scenario is most easily reproducible with igt@i915_module_load@reload-with-fault-injection. Fix the issue by moving the cleanup step to driver release path. (cherry picked from commit 795dbde92fe5c6996a02a5b579481de73035e7bf)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于drm/i915/huc中早期探测错误时未释放围栏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 27536e03271da3dafcdddf735102041a26ad5bd0 ~ 9f5ef4a5eaa61a7a4ed31231da45deb85065397a -
LinuxLinux 6.2 -

II. Public POCs for CVE-2025-37754

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37754

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-37754 (5)

Same Patch Batch · Linux · 2025-05-01 · 245 CVEs total

CVE-2025-377509.8 CRITICALsmb: client: fix UAF in decryption with multichannel
CVE-2025-377789.8 CRITICALksmbd: Fix dangling pointer in krb_authenticate
CVE-2022-497709.8 CRITICALceph: avoid putting the realm twice when decoding snaps fails
CVE-2022-499318.8 HIGHIB/hfi1: Correctly move list in sc_disable()
CVE-2025-377768.8 HIGHksmbd: fix use-after-free in smb_break_all_levII_oplock()
CVE-2025-377778.8 HIGHksmbd: fix use-after-free in __smb2_lease_break_noti()
CVE-2025-377908.8 HIGHnet: mctp: Set SOCK_RCU_FREE
CVE-2022-499108.8 HIGHBluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
CVE-2022-498868.4 HIGHx86/tdx: Panic on bad configs that #VE on "private" memory access
CVE-2025-231598.4 HIGHmedia: venus: hfi: add a check to handle OOB in sfr region
CVE-2025-377498.2 HIGHnet: ppp: Add bound checking for skb data on ppp_sync_txmung
CVE-2025-377657.8 HIGHdrm/nouveau: prime: fix ttm_bo_delayed_delete oops
CVE-2025-377797.8 HIGHlib/iov_iter: fix to increase non slab folio refcount
CVE-2022-499207.8 HIGHnetfilter: nf_tables: netlink notifier might race to release objects
CVE-2022-499197.8 HIGHnetfilter: nf_tables: release flow rule object from commit path
CVE-2022-499217.8 HIGHnet: sched: Fix use after free in red_enqueue()
CVE-2025-377527.8 HIGHnet_sched: sch_sfq: move the limit validation
CVE-2025-377567.8 HIGHnet: tls: explicitly disallow disconnect
CVE-2025-377617.8 HIGHdrm/xe: Fix an out-of-bounds shift when invalidating TLB
CVE-2022-498047.8 HIGHs390: avoid using global register for current_stack_pointer

Showing top 20 of 245 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37754

No comments yet

Leave a comment