CVE-2025-38515

drm/sched: Increment job count before swapping tail spsc queue

published August 16, 2025

CVSS
—
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Increment job count before swapping tail spsc queue

A small race exists between spsc_queue_push and the run-job worker, in

which spsc_queue_push may return not-first while the run-job worker has

already idled due to the job count being zero. If this race occurs, job

scheduling stops, leading to hangs while waiting on the job’s DMA

fences.

Seal this race by incrementing the job count before appending to the

SPSC queue.

This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in

an SVM test case.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Published
2025-08-16T10:55Z
EPSS history
Timeline
  • 16 AUG 10:55Z
    drm/sched: Increment job count before swapping tail spsc queue
    cvelistv5