CVE-2025-38515 Details
Description
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Increment job count before swapping tail spsc queue A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences. Seal this race by incrementing the job count before appending to the SPSC queue. This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case.
A race condition vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) scheduler, specifically within the single-producer, single-consumer (SPSC) queue management. This vulnerability arises because the function responsible for pushing jobs onto the SPSC queue can return a 'not-first' status while the job execution worker has already paused, due to the job count being zero. When this race condition occurs, it disrupts the job scheduling process, causing the system to hang while waiting for the job's Direct Memory Access (DMA) fences to be released. This issue was observed in a DRM-tip 6.16-rc1 build using the Xe driver, during a Shared Virtual Memory (SVM) test case.
The vulnerability has been addressed by modifying the SPSC queue management to increment the job count before adding a new job to the queue. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/549a9c78c3ea6807d0dc4162a4f5ba59f217d5a0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8af39ec5cf2be522c8eb43a3d8005ed59e4daaee | kernel.org | Patch |
| https://git.kernel.org/stable/c/c64f5310530baf75328292f9b9f3f2961d185183 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e2d6547dc8b9b332f9bc00875197287a6a4db65a | kernel.org | Patch |
| https://git.kernel.org/stable/c/e62f51d0ec8a9baf324caf9a564f8e318d36a551 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ef58a95457466849fa7b31fd3953801a5af0f58b | kernel.org | Patch |
| https://git.kernel.org/stable/c/ef841f8e4e1ff67817ca899bedc5ebb00847c0a7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f9a4f28a4fc4ee453a92a9abbe36e26224d17749 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.16, < 5.4.296 >= 5.5, < 5.10.240 >= 5.11, < 5.15.189 >= 5.16, < 6.1.146 >= 6.2, < 6.6.99 >= 6.7, < 6.12.39 >= 6.13, < 6.15.7 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 16, 2025 | New CVE Received | kernel.org |