CVE-2025-38011 [Medium] | Information Disclosure in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: csa unmap use uninterruptible lock After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace. Change to use uninterruptible wait lock fix the issue. WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: <TASK> drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0 (cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.07%	0.16%	+0.09%
2	2026-04-14	0.02%	0.07%	+0.05%
3	2025-06-18	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.07%

0.16%

+0.09%

2026-04-14

0.02%

0.07%

+0.05%

2025-06-18

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

OS Trackers for CVE-2025-38011

vendor	priority	summary	link
`debian`	unimportant	CVE-2025-38011 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2025-38011
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2025-38011
`suse`	medium	—	https://www.suse.com/security/cve/CVE-2025-38011/
`ubuntu`	medium	CVE-2025-38011 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, ignored 168, released 136, needed 77, not-affected 22, needs-triage 2, pending 1.	https://ubuntu.com/security/CVE-2025-38011

Affected software / configurations for CVE-2025-38011

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 6.6, < 6.12.30	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.14.8	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc1::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc2::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc3::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc4::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc5::::::
linux	linux_kernel	6.15	cpe:2.3:o:linux:linux_kernel:6.15:rc6::::::

References for CVE-2025-38011

URL	Tags
https://git.kernel.org/stable/c/8d2979b9bb1be0f4a52dff600e56d780403e04ac	Patch
https://git.kernel.org/stable/c/8d71c3231b33e24a911b8f2d8c3a17ee40aa32d5	Patch
https://git.kernel.org/stable/c/a0fa7873f2f869087b1e7793f7fac3713a1e3afe	Patch
https://git.kernel.org/stable/c/a1adc8d9a0d219d4e88672c30dbc9ea960d73136	Patch

URL

CVE-2025-38011 | drm/amdgpu: csa unmap use uninterruptible lock

Exploit prediction scoring system (EPSS) score for CVE-2025-38011

Common vulnerability scoring system (CVSS) metrics for CVE-2025-38011

Weakness enumeration for CVE-2025-38011

OS Trackers for CVE-2025-38011

Affected software / configurations for CVE-2025-38011

References for CVE-2025-38011