7.8

CVE-2025-38095: debian debian_linux NULL Pointer Dereference

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-38095DEBIAN-CVE-2025-38095
Published 03-07-2025Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2025-38095 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.21%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 46 · Related 44
DLA-4271-1DLA-4327-1OPENSUSE-SU-2025:20081-1SUSE-SU-2025:02853-1SUSE-SU-2025:02923-1SUSE-SU-2025:02969-1

Timeline

  1. 03-07-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

+0.02 pp

From 0.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu140 products
  • linuxAll versions (No fix recorded) | < 5.15.0-163.173 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1097.104 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < 90eb79c4ed98a4e24a62ccf61c199ab0f680fa8f | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < d0b7f11dd68b593bd970e5735be00e8d89bace30 | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < 3becc659f9cb76b481ad1fb71f54d5c8d6332d3f | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < c9d2b9a80d06a58f37e0dc8c827075639b443927 | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < fe1bebd0edb22e3536cbc920ec713331d1367ad4 | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < 08680c4dadc6e736c75bc2409d833f03f9003c51 | ≥ a590d0fdbaa56f482ff515e1040b6d9b1b200d63, < 72c7d62583ebce7baeb61acce6057c361f73be4a | 5.0
  • linux_kernel≥ 5.0, < 5.10.241 | ≥ 5.11, < 5.15.192 | ≥ 5.16, < 6.1.140 | ≥ 6.2, < 6.6.92 | ≥ 6.7, < 6.12.30 | ≥ 6.13, < 6.14.8 | 6.15:rc1 | 6.15:rc2 | 6.15:rc3 | 6.15:rc4 | 6.15:rc5 | 6.15:rc6

3 vendors · 144 products

References

41 links
Show all 41 references