CVE-2025-40111

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40111", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.167Z", "datePublished": "2025-11-12T01:07:25.203Z", "dateUpdated": "2026-10-15T22:02:38.116Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:51.842Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through `DRM_IOCTL_VMW_EXECBUF` on the vmwgfx DRM device node, which requires local execution to issue ioctls. There is no network or adjacent-network path into the command-submission validation code.\nAC:L - The attacker controls both sides of the race \u2014 one thread loops `vmw_execbuf_ioctl()` over a DX context with bound resources while another destroys a bound view/shader/surface \u2014 and the window is widened because `vmw_resource_release()` drops the kref and then blocks on `binding_mutex` that the execbuf walker already holds. The attempt is infinitely repeatable, and a single success permanently poisons the device-global `res_ht`.\nPR:L - `DRM_IOCTL_VMW_EXECBUF` is marked `DRM_RENDER_ALLOW`, so any unprivileged local user holding an fd on `/dev/dri/renderD*` (the default for logged-in desktop users, GPU-enabled containers, and sandboxed GPU processes in VMware guests) can reach it. No capability, DRM master status, or authentication is needed.\nUI:N - The attacking process drives both the execbuf submission and the concurrent resource destruction entirely on its own via ioctls. No action by another user or administrator is required.\nS:U - The corruption is confined to the guest kernel's own memory within the same security authority; no hypervisor, IOMMU, or VM boundary is crossed even though vmwgfx is a paravirtual GPU driver.\nC:H - The stale hlist entry points into a page freed to the buddy allocator, so subsequent `hash_for_each_possible_rcu()` walks read attacker-groomed memory; a matching sprayed `hash->key` yields a fully fabricated `vmw_validation_res_node` whose `private` data is consumed as `struct vmw_ctx_validation_info` pointers, enabling arbitrary kernel memory disclosure.\nI:H - `hash_add_rcu()` writes a kernel pointer into the freed page through the dangling node's `pprev`, and a sprayed fake node supplies attacker-controlled `res`, `ctx`, and binding-state pointers that the binding/validation code dereferences and writes through \u2014 a use-after-free with both write and control-flow-hijack primitives.\nA:H - The dangling hash entry survives in the device-global `res_ht` and is traversed by every later execbuf from any process on that device, so a single trigger reliably produces list corruption and oopses/panics affecting the whole system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "versions": [{"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "1822e5287b7dfa59d0af966756ebf1dc652b60ee", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "fb7165e5f3b3b10721ff70553583ad12e90e447a", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "4c918f9d1ccccc0e092f43dcb2d8266f54d7340b", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "9a8eaca539708ca532747f606d231f70e684e8ca", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "867bda5d95d36f10da398fd4409e21c7002b2332", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "655a2f29bfc21105c80bf8a7d7aafa6eca8b4496", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "65608e991c2d771c13404e5c7ae122ac3c3357a4", "status": "affected", "versionType": "git"}, {"version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "dfe1323ab3c8a4dd5625ebfdba44dc47df84512a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.157", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee"}, {"url": "https://git.kernel.org/stable/c/fb7165e5f3b3b10721ff70553583ad12e90e447a"}, {"url": "https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b"}, {"url": "https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca"}, {"url": "https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332"}, {"url": "https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496"}, {"url": "https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4"}, {"url": "https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a"}], "title": "drm/vmwgfx: Fix Use-after-free in validation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:01.164715Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:38.116Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:01.164715Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:57:02.742Z"}}], "cna": {"title": "drm/vmwgfx: Fix Use-after-free in validation", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through `DRM_IOCTL_VMW_EXECBUF` on the vmwgfx DRM device node, which requires local execution to issue ioctls. There is no network or adjacent-network path into the command-submission validation code.\nAC:L - The attacker controls both sides of the race \u2014 one thread loops `vmw_execbuf_ioctl()` over a DX context with bound resources while another destroys a bound view/shader/surface \u2014 and the window is widened because `vmw_resource_release()` drops the kref and then blocks on `binding_mutex` that the execbuf walker already holds. The attempt is infinitely repeatable, and a single success permanently poisons the device-global `res_ht`.\nPR:L - `DRM_IOCTL_VMW_EXECBUF` is marked `DRM_RENDER_ALLOW`, so any unprivileged local user holding an fd on `/dev/dri/renderD*` (the default for logged-in desktop users, GPU-enabled containers, and sandboxed GPU processes in VMware guests) can reach it. No capability, DRM master status, or authentication is needed.\nUI:N - The attacking process drives both the execbuf submission and the concurrent resource destruction entirely on its own via ioctls. No action by another user or administrator is required.\nS:U - The corruption is confined to the guest kernel's own memory within the same security authority; no hypervisor, IOMMU, or VM boundary is crossed even though vmwgfx is a paravirtual GPU driver.\nC:H - The stale hlist entry points into a page freed to the buddy allocator, so subsequent `hash_for_each_possible_rcu()` walks read attacker-groomed memory; a matching sprayed `hash->key` yields a fully fabricated `vmw_validation_res_node` whose `private` data is consumed as `struct vmw_ctx_validation_info` pointers, enabling arbitrary kernel memory disclosure.\nI:H - `hash_add_rcu()` writes a kernel pointer into the freed page through the dangling node's `pprev`, and a sprayed fake node supplies attacker-controlled `res`, `ctx`, and binding-state pointers that the binding/validation code dereferences and writes through \u2014 a use-after-free with both write and control-flow-hijack primitives.\nA:H - The dangling hash entry survives in the device-global `res_ht` and is traversed by every later execbuf from any process on that device, so a single trigger reliably produces list corruption and oopses/panics affecting the whole system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "1822e5287b7dfa59d0af966756ebf1dc652b60ee", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "fb7165e5f3b3b10721ff70553583ad12e90e447a", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "4c918f9d1ccccc0e092f43dcb2d8266f54d7340b", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "9a8eaca539708ca532747f606d231f70e684e8ca", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "867bda5d95d36f10da398fd4409e21c7002b2332", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "655a2f29bfc21105c80bf8a7d7aafa6eca8b4496", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "65608e991c2d771c13404e5c7ae122ac3c3357a4", "versionType": "git"}, {"status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "lessThan": "dfe1323ab3c8a4dd5625ebfdba44dc47df84512a", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.301", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.246", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.195", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.157", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.113", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.54", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.4", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee"}, {"url": "https://git.kernel.org/stable/c/fb7165e5f3b3b10721ff70553583ad12e90e447a"}, {"url": "https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b"}, {"url": "https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca"}, {"url": "https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332"}, {"url": "https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496"}, {"url": "https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4"}, {"url": "https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.301", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.246", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.195", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.157", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.113", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.54", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.4", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:51.842Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40111", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:38.116Z", "dateReserved": "2025-04-16T07:20:57.167Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-11-12T01:07:25.203Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1822e5287b7dfa59d0af966756ebf1dc652b60ee", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "fb7165e5f3b3b10721ff70553583ad12e90e447a", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "4c918f9d1ccccc0e092f43dcb2d8266f54d7340b", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "9a8eaca539708ca532747f606d231f70e684e8ca", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "867bda5d95d36f10da398fd4409e21c7002b2332", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "655a2f29bfc21105c80bf8a7d7aafa6eca8b4496", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "65608e991c2d771c13404e5c7ae122ac3c3357a4", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}, {"lessThan": "dfe1323ab3c8a4dd5625ebfdba44dc47df84512a", "status": "affected", "version": "64ad2abfe9a628ce79859d072704bd1ef7682044", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.157", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.113", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/vmwgfx: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en la validaci\u00f3n\n\nLos nodos almacenados en la tabla hash de duplicados de validaci\u00f3n provienen de un asignador de arena que se limpia al final de vmw_execbuf_process. Se espera que todos los nodos se limpien en vmw_validation_drop_ht, pero este nodo escap\u00f3 porque su recurso fue destruido prematuramente."}], "id": "CVE-2025-40111", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40111", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:57:01.164715Z", "version": "2.0.3"}}]}, "published": "2025-11-12T02:15:33.050", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb7165e5f3b3b10721ff70553583ad12e90e447a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/vmwgfx: Fix Use-after-free in validation", "id": "2414322", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414322"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vmwgfx: Fix Use-after-free in validation\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely."], "name": "CVE-2025-40111", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40111\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40111\nhttps://lore.kernel.org/linux-cve-announce/2025111229-CVE-2025-40111-23d1@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T12:36:25.846110+00:00", "updated": "2025-11-12T12:36:25.846149+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}