Critical Vulnerability in Linux Kernel Affecting Debian Packages: CVE-2025-38389
Summary
CVE-2025-38389: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is a highly versatile and widely used open-source operating system kernel. The vulnerability CVE-2025-38389 affects multiple Debian versions (11, 12, and 13) and is related to the i915 graphics driver, which can lead to resource management issues during driver unbinding.
Vulnerability Detail
CVE-2025-38389 is a vulnerability in the Linux kernel's i915 graphics driver that can cause a timeline reference to remain held during a Virtual Memory Area (VMA) allocation error. This can lead to resource leaks and potential system instability when the driver is unbound. The issue arises when the allocation fails due to interruptions, leaving the timeline referenced and not released, which can cause subsequent IOCTL calls to fail.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid unbinding the i915 driver during active operations or tests that may trigger the vulnerability. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2025-38389 is a significant vulnerability in the Linux kernel's i915 graphics driver affecting multiple Debian versions. It is crucial to update to the patched version to ensure system stability and security. Regular monitoring and updates are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38389 is a vulnerability in the Linux kernel's i915 graphics driver that can lead to resource management issues.
Debian versions 11, 12, and 13 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to resource leaks and system instability, especially during driver unbinding operations.
Yes, a patch is available for Debian 13 in version 6.12.37-1. Updating to this version will resolve the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
