CVE-2025-37765: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37765 is a vulnerability discovered in the Linux kernel's DRM (Direct Rendering Manager) Nouveau driver, reported on May 1, 2025. The vulnerability affects the ttm_bo_delayed_delete function, resulting in a general protection fault due to dereferencing a dangling pointer (NVD, Wiz).

The vulnerability occurs in the drm/nouveau driver's prime functionality when drm_prime_gem_destroy calls dma_buf_put(dma_buf), releasing the reference to the shared dma_buf. When the reference count reaches 0, the dma_buf is destroyed, which decrements the corresponding amdgpu_bo reference count to 0, leading to the amdgpu_bo being destroyed. This creates a dangling pointer in nouveau_bo obj->bo.base.resv to the formerly allocated amdgpu_bo memory. The issue manifests when nouveau_gem_object_del calls ttm_bo_put(&nvbo->bo), triggering ttm_bo_release, which schedules ttm_bo_delayed_delete. The CVSS v3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (Red Hat).

The vulnerability can cause system crashes through a general protection fault, potentially affecting system stability and availability. The issue specifically impacts systems running the Linux kernel with the Nouveau graphics driver (Wiz).

The vulnerability requires local access to exploit, with low attack complexity and privileged access. No public exploits have been reported in the wild (Red Hat).

The vulnerability has been fixed by moving the drm_prime_gem_destroy call from nouveau_gem_object_del to nouveau_bo_del_ttm, ensuring it runs after ttm_bo_delayed_delete. This fix has been implemented in Linux kernel version 6.12.25-1 for some distributions, while others like Debian Bookworm have received the fix in version 6.1.135-1 (Debian Tracker).