CVE-2025-38722— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于habanalabs驱动在导出dmabuf时未正确处理文件描述符，可能导致释放后重用。
可能的 ATT&CK 技术 1 AI
T1203 · Exploitation for Client Execution影响版本矩阵 12
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | db1a8dd916aac986871f6b873a3aefad906f383a< d26058c2349d77d1ef179a2cc9752ca12004b6ff |
affected |
db1a8dd916aac986871f6b873a3aefad906f383a< c07886761fd6251db6938d4e747002e3d150d231 |
affected | ||
db1a8dd916aac986871f6b873a3aefad906f383a< 40deceb38f9db759772d1c289c28fd2a543f57fc |
affected | ||
db1a8dd916aac986871f6b873a3aefad906f383a< 55c232d7e0241f1d5120b595e7a9de24c75ed3d8 |
affected | ||
db1a8dd916aac986871f6b873a3aefad906f383a< 33927f3d0ecdcff06326d6e4edb6166aed42811c |
affected | ||
5.16 |
affected | ||
< 5.16 |
unaffected | ||
6.6.160≤ 6.6.* |
unaffected | ||
| … +4 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2025-38722 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
habanalabs: fix UAF in export_dmabuf()
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
habanalabs: fix UAF in export_dmabuf()
As soon as we'd inserted a file reference into descriptor table, another
thread could close it. That's fine for the case when all we are doing is
returning that descriptor to userland (it's a race, but it's a userland
race and there's nothing the kernel can do about it). However, if we
follow fd_install() with any kind of access to objects that would be
destroyed on close (be it the struct file itself or anything destroyed
by its ->release()), we have a UAF.
dma_buf_fd() is a combination of reserving a descriptor and fd_install().
habanalabs export_dmabuf() calls it and then proceeds to access the
objects destroyed on close. In particular, it grabs an extra reference to
another struct file that will be dropped as part of ->release() for ours;
that "will be" is actually "might have already been".
Fix that by reserving descriptor before anything else and do fd_install()
only when everything had been set up. As a side benefit, we no longer
have the failure exit with file already created, but reference to
underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet;
unlike dma_buf_fd(), fd_install() can't fail.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于habanalabs驱动在导出dmabuf时未正确处理文件描述符，可能导致释放后重用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2025-38722 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2025-38722 的情报信息
请登录查看更多情报信息。
CVE-2025-38722 补丁与修复 (1)
同批安全公告 · Linux · 2025-09-04 · 共 52 条
| CVE-2025-38708 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2025-38724 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2025-38728 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2025-38688 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38697 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38715 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38717 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38718 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38714 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38685 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38710 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38730 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38703 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38679 | 7.3 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38687 | 7.3 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38713 | 7.1 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38707 | 7.1 HIGH | Linux kernel 安全漏洞 |
| CVE-2025-38680 | Linux kernel 安全漏洞 | |
| CVE-2025-38693 | Linux kernel 安全漏洞 | |
| CVE-2025-38681 | Linux kernel 安全漏洞 |
显示前 20 条，共 52 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2025-38722
暂无评论