Critical Vulnerability in Linux Kernel: drm/scheduler Job Dependency Issue
Summary
CVE-2025-38436: In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability affects the drm/scheduler component, which handles job scheduling for graphics processing, potentially leading to application hangs under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/scheduler component, where the function drm_sched_entity_kill() fails to properly signal scheduled fences when an application entity is killed. This can lead to a situation where dependent applications hang indefinitely, waiting for a dependency that will never be resolved. The issue arises when application B is terminated, and its scheduled fences are not signaled, preventing application A from clearing its dependency. This can severely impact system performance and user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is advisable to monitor the system for any affected applications and apply the patch as soon as it is available.
Conclusion
The CVE-2025-38436 vulnerability in the Linux kernel's drm/scheduler component poses a significant risk by causing dependent applications to hang indefinitely. It is crucial to update to the patched version to ensure system stability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38436 is a vulnerability in the Linux kernel's drm/scheduler component that can cause dependent applications to hang indefinitely.
If your applications depend on scheduled jobs from another application that gets killed, they may hang while waiting for a dependency that will never be resolved.
Yes, a patch is available for Debian 13 in version 6.12.37-1. It is recommended to update to this version to mitigate the vulnerability.
While there is no specific workaround, it is advisable to monitor your applications for any unusual behavior and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
