CVE-2025-38187

{"id": "CVE-2025-38187", "cveTags": [], "metrics": {}, "published": "2025-07-04T14:15:25.640", "references": [{"url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller's RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller's container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/nouveau: se corrige un error de use-after-free en r535_gsp_rpc_push(). El contenedor RPC se libera tras pasarse a r535_gsp_rpc_send(). Al enviar el fragmento inicial de una RPC grande y pasar el contenedor RPC del emisor, este se liberar\u00e1 prematuramente. Por lo tanto, los intentos posteriores de enviar los fragmentos restantes resultar\u00e1n en un error de use-after-free. Asigne un contenedor RPC temporal para almacenar el fragmento inicial de una RPC grande durante el env\u00edo. Libere el contenedor del emisor cuando todos los fragmentos se hayan enviado correctamente. [Rebase sobre los cambios de Blackwell. - Danilo]"}], "lastModified": "2025-07-08T16:18:53.607", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}