Listen to this Post
The vulnerability occurs in the Linux kernel’s drm/xe/vm subsystem, which manages virtual memory for Intel Xe graphics. During initialization or operation, a scratch page table pointer (scratch_pt) may be set to an error pointer (e.g., ERR_PTR(-ENOMEM)) if an error like memory allocation fails. Later, during cleanup in the xe_vm_free_scratch() function, this pointer is dereferenced without validation, assuming it is a valid pointer. Since error pointers are not valid memory addresses, dereferencing them causes a kernel crash or a use-after-free condition. This can be triggered by inducing an error state, such as memory pressure, during VM operations. The fix involves clearing the scratch_pt pointer to NULL on error, preventing the erroneous dereference during cleanup and avoiding system instability.
Platform: Linux kernel
Version: Affected kernel versions
Vulnerability: Pointer dereference error
Severity: Medium
date: 09/16/2025
Prediction: Expected patch 09/16/2025
What Undercode Say:
Showing bash commands and codes related to the blog
Check kernel version
uname -r
Grep for fix commit
git log –grep=”358ee50ab565f3c8ea32480e9d03127a81ba32f8″
Code snippet from fix
if (IS_ERR(scratch_pt))
scratch_pt = NULL;
how Exploit:
Trigger error conditions to set scratch_pt to error pointer, causing kernel crash on cleanup for denial-of-service.
Protection from this CVE
Update kernel to version containing fix commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8.
Impact:
Kernel crash, denial-of-service, potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
