CVE-2025-38189: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38189 is a NULL pointer dereference vulnerability in the Linux kernel's DRM (Direct Rendering Manager) V3D driver, specifically in the v3d_job_update_stats() function. The flaw is triggered when a file descriptor is closed before submitted GPU jobs complete, causing the kernel to attempt updating GPU statistics via a NULL pointer and resulting in a kernel panic (Oops). Affected kernel versions span from 4.18 up to (but not including) 6.12.35, and from 6.13 up to (but not including) 6.15.4, as well as release candidates 6.16-rc1 and 6.16-rc2. It was published on July 4, 2025, with patches available as of November 2025. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a NULL pointer dereference (CWE-476) in the V3D GPU driver's v3d_job_update_stats() function within the Linux kernel's DRM subsystem. When a user-space process closes its file descriptor associated with pending GPU jobs before those jobs finish executing, the per-file-descriptor statistics structure may be freed or set to NULL; the kernel then attempts to dereference this pointer to update global and per-FD GPU statistics, triggering a level 1 translation fault at virtual address 0x0000000000000588. The attack vector is local, requiring low privileges and no user interaction, making it exploitable by any unprivileged local user on a system with a V3D GPU (e.g., Raspberry Pi with VideoCore VI). The kernel Oops was originally reported by Mesa CI on a Raspberry Pi running kernel 6.12.25 (Feedly).

Successful exploitation causes a kernel panic (denial of service), rendering the affected system unresponsive and requiring a reboot. The vulnerability has no confidentiality or integrity impact — only availability is affected, as the crash terminates all running processes and services on the host. Systems using the V3D GPU driver (primarily Raspberry Pi devices with VideoCore VI/VII GPUs running Linux) are at risk, and the impact is limited to the local system with no lateral movement potential (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across three stable commits: 4f47014, c886784, and e1bc3a1. Users should upgrade to kernel version 6.12.35 or later (for the 6.12 stable series) or 6.15.4 or later (for the 6.15 series). Downstream distributions including Ubuntu (USN-7834-1, USN-7856-1), SUSE, and openSUSE have also issued updated kernel packages. As a short-term workaround where patching is not immediately possible, restricting local user access to GPU devices can reduce exposure (Feedly, Ubuntu USN-7834-1, Ubuntu USN-7856-1).

The vulnerability was initially surfaced through Mesa CI testing on Raspberry Pi hardware, indicating it was caught through automated GPU driver testing rather than adversarial discovery. Downstream Linux distributions (Ubuntu, SUSE, openSUSE) have responded promptly with kernel security updates. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Feedly).