CVE-2025-38036: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38036 is a null pointer dereference (NPD) vulnerability in the Linux kernel's drm/xe/vf driver, affecting systems running in SR-IOV Virtual Function (VF) mode. The flaw arises because recent kernel refactoring caused GT MMIO members (gt->mmio) to be initialized later than expected, leading to a kernel page fault crash when VF code attempts to communicate with the GuC (Graphics Unified Compute) to read the GMDID value. Affected versions span Linux kernel 6.8 through 6.14.8 (exclusive of 6.14.9). It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a null pointer dereference (CWE-476) in the drm/xe/vf subsystem of the Linux kernel. When a system operates in SR-IOV VF mode, the VF driver must communicate with the GuC via xe_mmio_read|write() to obtain the GMDID value; however, due to a refactoring change, gt->mmio is no longer initialized at the point these calls are made, resulting in an attempt to access an unset MMIO register address (0x0000000000190240) and triggering a kernel BUG/page fault. The fix involves calling xe_gt_mmio_init() early — before GuC communication — to ensure the MMIO members are properly set up, mirroring the existing workaround already applied for Media GT type mimicry (Feedly, Kernel Patch 1, Kernel Patch 2). Exploitation requires local access with low privileges on a system using Intel Xe GPU hardware in SR-IOV VF mode.

Successful exploitation causes a kernel panic (page fault/BUG) resulting in a system crash and denial of service. There is no confidentiality or integrity impact — only availability is affected, as the crash brings down the affected kernel instance. Systems using Intel Xe GPU hardware in SR-IOV VF mode (e.g., virtualized environments with GPU passthrough) are at risk of unexpected reboots or service interruption (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local, low-privileged access on a system with an Intel Xe GPU configured in SR-IOV VF mode, significantly limiting the attack surface.

• Logs: Kernel log entries containing BUG: unable to handle page fault for address: 0000000000190240 or similar NPD crash messages in dmesg or /var/log/kern.log.
• Logs: Messages from the xe DRM driver such as xe 0000:00:02.X: [drm] Running in SR-IOV VF mode followed immediately by a kernel oops or panic trace.
• Logs: Stack traces referencing xe_mmio_read, xe_mmio_write, or GuC H2G MMIO communication (e.g., GT0: sending H2G MMIO 0x5507) preceding a crash.
• Process/System: Unexpected system reboots or kernel panics on hosts running Intel Xe GPU hardware in SR-IOV VF mode with kernel versions 6.8–6.14.8.

The primary remediation is to upgrade the Linux kernel to version 6.14.9 or 6.15, which include the fix (xe_gt_mmio_init() called early in the VF initialization path) (Kernel Patch 1, Kernel Patch 2). Ubuntu has issued security notices USN-7769-1, USN-7769-2, and USN-7789-1 addressing this vulnerability (Ubuntu USN-7769-1, Ubuntu USN-7789-1). As a temporary workaround for systems that cannot be patched immediately, disabling SR-IOV VF mode for the Intel Xe GPU or restricting low-privileged local access to affected systems can reduce exposure (Feedly).