{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2025-38520 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38520 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38520 and fix it if it is affected.\n\nWhat it is: CVE-2025-38520 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38520 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38520/ (Markdown: https://insights.sbomify.com/CVE-2025-38520/index.md)","id":"CVE-2025-38520","markdown":"https://insights.sbomify.com/CVE-2025-38520/index.md","name":"CVE-2025-38520","record":{"aliases":["AZL-66420","AZL-73551","BELL-CVE-2025-38520","DEBIAN-CVE-2025-38520","GHSA-8w9j-8c65-frh3","ROOT-OS-DEBIAN-12-CVE-2025-38520","ROOT-OS-DEBIAN-13-CVE-2025-38520","ROOT-OS-UBUNTU-2204-CVE-2025-38520","ROOT-OS-UBUNTU-2404-CVE-2025-38520","UBUNTU-CVE-2025-38520"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A race condition in the AMD KFD driver causes a deadlock and VRAM leak, leading to denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Don't call mmput from MMU notifier callback\n\nIf the process is exiting, the mmput inside mmu notifier callback from\ncompactd or fork or numa balancing could release the last reference\nof mm struct to call exit_mmap and free_pgtable, this triggers deadlock\nwith below backtrace.\n\nThe deadlock will leak kfd process as mmu notifier release is not called\nand cause VRAM leaking.\n\nThe fix is to take mm reference mmget_non_zero when adding prange to the\ndeferred list to pair with mmput in deferred list work.\n\nIf prange split and add into pchild list, the pchild work_item.mm is not\nused, so remove the mm parameter from svm_range_unmap_split and\nsvm_range_add_child.\n\nThe backtrace of hung task:\n\n INFO: task python:348105 blocked for more than 64512 seconds.\n Call Trace:\n  __schedule+0x1c3/0x550\n  schedule+0x46/0xb0\n  rwsem_down_write_slowpath+0x24b/0x4c0\n  unlink_anon_vmas+0xb1/0x1c0\n  free_pgtables+0xa9/0x130\n  exit_mmap+0xbc/0x1a0\n  mmput+0x5a/0x140\n  svm_range_cpu_invalidate_pagetables+0x2b/0x40 [amdgpu]\n  mn_itree_invalidate+0x72/0xc0\n  __mmu_notifier_invalidate_range_start+0x48/0x60\n  try_to_unmap_one+0x10fa/0x1400\n  rmap_walk_anon+0x196/0x460\n  try_to_unmap+0xbb/0x210\n  migrate_page_unmap+0x54d/0x7e0\n  migrate_pages_batch+0x1c3/0xae0\n  migrate_pages_sync+0x98/0x240\n  migrate_pages+0x25c/0x520\n  compact_zone+0x29d/0x590\n  compact_zone_order+0xb6/0xf0\n  try_to_compact_pages+0xbe/0x220\n  __alloc_pages_direct_compact+0x96/0x1a0\n  __alloc_pages_slowpath+0x410/0x930\n  __alloc_pages_nodemask+0x3a9/0x3e0\n  do_huge_pmd_anonymous_page+0xd7/0x3e0\n  __handle_mm_fault+0x5e3/0x5f0\n  handle_mm_fault+0xf7/0x2e0\n  hmm_vma_fault.isra.0+0x4d/0xa0\n  walk_pmd_range.isra.0+0xa8/0x310\n  walk_pud_range+0x167/0x240\n  walk_pgd_range+0x55/0x100\n  __walk_page_range+0x87/0x90\n  walk_page_range+0xf6/0x160\n  hmm_range_fault+0x4f/0x90\n  amdgpu_hmm_range_get_pages+0x123/0x230 [amdgpu]\n  amdgpu_ttm_tt_get_user_pages+0xb1/0x150 [amdgpu]\n  init_user_pages+0xb1/0x2a0 [amdgpu]\n  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x543/0x7d0 [amdgpu]\n  kfd_ioctl_alloc_memory_of_gpu+0x24c/0x4e0 [amdgpu]\n  kfd_ioctl+0x29d/0x500 [amdgpu]\n\n(cherry picked from commit a29e067bd38946f752b0ef855f3dfff87e77bec7)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/amdkfd: Don't call mmput from MMU notifier callback","id":"CVE-2025-38520","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"race_condition","year":"2025"},"n_packages":0,"n_references":5,"next":{"headline":"drm/imagination: Fix kernel crash when hard resetting the GPU","id":"CVE-2025-38521"},"packages":[],"prev":{"headline":"mm/damon: fix divide by zero in damon_get_intervals_score()","id":"CVE-2025-38519"},"products":["Linux"],"published":"2025-08-16","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-23","vendors":["Linux"]},"summary":"A race condition in the AMD KFD driver causes a deadlock and VRAM leak, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2025-38520/"}