CVE-2025-37951 (GCVE-0-2025-37951)
Vulnerability from cvelistv5
Published
2025-05-20 16:01
Modified
2025-07-07 08:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance to complete. However, when `timedout_job()` is called, the job in question is removed from the pending list, which means it won't be automatically freed through `free_job()`. Consequently, when we skip the reset and keep the job running, the job won't be freed when it finally completes. This situation leads to a memory leak, as exposed in [1] and [2]. Similarly to commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures the job is put back on the pending list when extending the timeout.
References
Impacted products
Vendor Product Version
Linux Linux Version: 57692c94dcbe99a1e0444409a3da13fb3443562c
Version: 57692c94dcbe99a1e0444409a3da13fb3443562c
Version: 57692c94dcbe99a1e0444409a3da13fb3443562c
Version: 57692c94dcbe99a1e0444409a3da13fb3443562c
Version: 57692c94dcbe99a1e0444409a3da13fb3443562c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5235b56b7e5449d990d21d78723b1a5e7bb5738e",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "12125f7d9c15e6d8ac91d10373b2db2f17dcf767",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "a5f162727b91e480656da1876247a91f651f76de",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "422a8b10ba42097a704d6909ada2956f880246f2",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "35e4079bf1a2570abffce6ababa631afcf8ea0e5",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.139",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Add job to pending list if the reset was skipped\n\nWhen a CL/CSD job times out, we check if the GPU has made any progress\nsince the last timeout. If so, instead of resetting the hardware, we skip\nthe reset and let the timer get rearmed. This gives long-running jobs a\nchance to complete.\n\nHowever, when `timedout_job()` is called, the job in question is removed\nfrom the pending list, which means it won\u0027t be automatically freed through\n`free_job()`. Consequently, when we skip the reset and keep the job\nrunning, the job won\u0027t be freed when it finally completes.\n\nThis situation leads to a memory leak, as exposed in [1] and [2].\n\nSimilarly to commit 704d3d60fec4 (\"drm/etnaviv: don\u0027t block scheduler when\nGPU is still active\"), this patch ensures the job is put back on the\npending list when extending the timeout."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-07T08:45:50.595Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5235b56b7e5449d990d21d78723b1a5e7bb5738e"
        },
        {
          "url": "https://git.kernel.org/stable/c/12125f7d9c15e6d8ac91d10373b2db2f17dcf767"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f162727b91e480656da1876247a91f651f76de"
        },
        {
          "url": "https://git.kernel.org/stable/c/422a8b10ba42097a704d6909ada2956f880246f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e4079bf1a2570abffce6ababa631afcf8ea0e5"
        }
      ],
      "title": "drm/v3d: Add job to pending list if the reset was skipped",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37951",
    "datePublished": "2025-05-20T16:01:46.555Z",
    "dateReserved": "2025-04-16T04:51:23.973Z",
    "dateUpdated": "2025-07-07T08:45:50.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37951\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:33.220\",\"lastModified\":\"2025-05-21T20:24:58.133\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Add job to pending list if the reset was skipped\\n\\nWhen a CL/CSD job times out, we check if the GPU has made any progress\\nsince the last timeout. If so, instead of resetting the hardware, we skip\\nthe reset and let the timer get rearmed. This gives long-running jobs a\\nchance to complete.\\n\\nHowever, when `timedout_job()` is called, the job in question is removed\\nfrom the pending list, which means it won\u0027t be automatically freed through\\n`free_job()`. Consequently, when we skip the reset and keep the job\\nrunning, the job won\u0027t be freed when it finally completes.\\n\\nThis situation leads to a memory leak, as exposed in [1] and [2].\\n\\nSimilarly to commit 704d3d60fec4 (\\\"drm/etnaviv: don\u0027t block scheduler when\\nGPU is still active\\\"), this patch ensures the job is put back on the\\npending list when extending the timeout.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Agregar trabajo a la lista de pendientes si se omiti\u00f3 el reinicio Cuando se agota el tiempo de espera de un trabajo CL/CSD, verificamos si la GPU ha progresado desde el \u00faltimo tiempo de espera. Si es as\u00ed, en lugar de reiniciar el hardware, omitimos el reinicio y dejamos que el temporizador se reactive. Esto les da a los trabajos de larga ejecuci\u00f3n la oportunidad de completarse. Sin embargo, cuando se llama a `timedout_job()`, el trabajo en cuesti\u00f3n se elimina de la lista de pendientes, lo que significa que no se liberar\u00e1 autom\u00e1ticamente a trav\u00e9s de `free_job()`. En consecuencia, cuando omitimos el reinicio y mantenemos el trabajo en ejecuci\u00f3n, el trabajo no se liberar\u00e1 cuando finalmente se complete. Esta situaci\u00f3n conduce a una fuga de memoria, como se expone en [1] y [2]. De manera similar a el commit 704d3d60fec4 (\\\"drm/etnaviv: no bloquee el programador cuando la GPU a\u00fan est\u00e9 activa\\\"), este parche garantiza que el trabajo se vuelva a colocar en la lista de pendientes al extender el tiempo de espera.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12125f7d9c15e6d8ac91d10373b2db2f17dcf767\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35e4079bf1a2570abffce6ababa631afcf8ea0e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/422a8b10ba42097a704d6909ada2956f880246f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5235b56b7e5449d990d21d78723b1a5e7bb5738e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a5f162727b91e480656da1876247a91f651f76de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.