CVE-2025-40336

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40336", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.186Z", "datePublished": "2025-12-09T04:09:52.845Z", "dateUpdated": "2026-10-15T22:02:46.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:42.657Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: fix hmm_pfn_to_map_order() usage\n\nHandle the case where the hmm range partially covers a huge page (like\n2M), otherwise we can potentially end up doing something nasty like\nmapping memory which is outside the range, and maybe not even mapped by\nthe mm. Fix is based on the xe userptr code, which in a future patch\nwill directly use gpusvm, so needs alignment here.\n\nv2:\n - Add kernel-doc (Matt B)\n - s/fls/ilog2/ (Thomas)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through DRM ioctls on the local render node /dev/dri/renderD* \u2014 DRM_IOCTL_XE_VM_CREATE with FAULT_MODE, VM_BIND of a CPU_ADDR_MIRROR range, then either a VM_BIND PREFETCH op or a GPU exec that faults. There is no network or remote-peer input on this path.\nAC:L - The attacker fully controls every precondition: it allocates the huge-page backing (madvise(MADV_HUGEPAGE) or hugetlbfs), and because drm_gpusvm_range_chunk_size() clamps the chunk to the caller-supplied xe_vma bounds, it can deterministically force a 4K/64K range inside a 2MB THP or a 2MB range at an arbitrary offset in a 1GB hugetlb page. No race, no memory-layout luck, and CONFIG_DRM_XE_GPUSVM defaults to y on every kernel that builds the xe driver.\nPR:L - Only an open file descriptor on the DRM render node is needed, which unprivileged local users hold via the render/video group, the logged-in-seat ACL, or a container with /dev/dri passed through. Neither xe_vm_create_ioctl() nor the VM_BIND/exec paths perform any capable() or CAP_SYS_* check.\nUI:N - The attacking process performs the whole sequence itself with its own ioctls and its own memory mappings. No other user or administrator has to mount, open, or interact with anything.\nS:C - The flaw makes the kernel program the IOMMU/DMA aperture for the GPU over physical memory outside the buffer the process owns, so the device is granted bidirectional DMA to memory that the DMA-isolation authority was supposed to withhold from it. The impacted resource lies beyond the security authority of the requesting process and of the driver that created the mapping, i.e. the DMA/IOMMU protection boundary is crossed.\nC:H - dma_map_page() is issued with PAGE_SIZE << order bytes starting mid-huge-page, so up to ~2MB (THP) or ~1GB (1GB hugetlb) of physical memory belonging to the kernel or to other processes is made device-readable; the same over-sized size is passed to dma_map_resource() on the P2P device-private path. The attacker chooses the offset within the huge page, so it controls how much foreign memory is exposed.\nI:H - The mappings are created with DMA_BIDIRECTIONAL, so the out-of-range physical window is device-writable, and the GPU engines are programmable by the same unprivileged user. Attacker-influenced DMA writes into kernel slab, page tables, or other processes' pages is an arbitrary-write primitive.\nA:H - Over-sized mappings (up to 1GB of IOVA per range) readily fail in dma_map_page(), and __xe_svm_handle_pagefault() turns the resulting -EFAULT into an unconditional \"goto retry\" while holding vm->lock for write, giving an unbounded retry loop; corrupting adjacent kernel memory via the stray DMA window likewise crashes the machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "versions": [{"version": "99624bdff8670795b678eafa6509aaad3a5c0175", "lessThan": "08e9fd78ba1b9e95141181c69cc51795c9888157", "status": "affected", "versionType": "git"}, {"version": "99624bdff8670795b678eafa6509aaad3a5c0175", "lessThan": "c50729c68aaf93611c855752b00e49ce1fdd1558", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157"}, {"url": "https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558"}], "title": "drm/gpusvm: fix hmm_pfn_to_map_order() usage", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40336", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:59:29.236103Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:46.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40336", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:59:29.236103Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:59:29.815Z"}}], "cna": {"title": "drm/gpusvm: fix hmm_pfn_to_map_order() usage", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through DRM ioctls on the local render node /dev/dri/renderD* \u2014 DRM_IOCTL_XE_VM_CREATE with FAULT_MODE, VM_BIND of a CPU_ADDR_MIRROR range, then either a VM_BIND PREFETCH op or a GPU exec that faults. There is no network or remote-peer input on this path.\nAC:L - The attacker fully controls every precondition: it allocates the huge-page backing (madvise(MADV_HUGEPAGE) or hugetlbfs), and because drm_gpusvm_range_chunk_size() clamps the chunk to the caller-supplied xe_vma bounds, it can deterministically force a 4K/64K range inside a 2MB THP or a 2MB range at an arbitrary offset in a 1GB hugetlb page. No race, no memory-layout luck, and CONFIG_DRM_XE_GPUSVM defaults to y on every kernel that builds the xe driver.\nPR:L - Only an open file descriptor on the DRM render node is needed, which unprivileged local users hold via the render/video group, the logged-in-seat ACL, or a container with /dev/dri passed through. Neither xe_vm_create_ioctl() nor the VM_BIND/exec paths perform any capable() or CAP_SYS_* check.\nUI:N - The attacking process performs the whole sequence itself with its own ioctls and its own memory mappings. No other user or administrator has to mount, open, or interact with anything.\nS:C - The flaw makes the kernel program the IOMMU/DMA aperture for the GPU over physical memory outside the buffer the process owns, so the device is granted bidirectional DMA to memory that the DMA-isolation authority was supposed to withhold from it. The impacted resource lies beyond the security authority of the requesting process and of the driver that created the mapping, i.e. the DMA/IOMMU protection boundary is crossed.\nC:H - dma_map_page() is issued with PAGE_SIZE << order bytes starting mid-huge-page, so up to ~2MB (THP) or ~1GB (1GB hugetlb) of physical memory belonging to the kernel or to other processes is made device-readable; the same over-sized size is passed to dma_map_resource() on the P2P device-private path. The attacker chooses the offset within the huge page, so it controls how much foreign memory is exposed.\nI:H - The mappings are created with DMA_BIDIRECTIONAL, so the out-of-range physical window is device-writable, and the GPU engines are programmable by the same unprivileged user. Attacker-influenced DMA writes into kernel slab, page tables, or other processes' pages is an arbitrary-write primitive.\nA:H - Over-sized mappings (up to 1GB of IOVA per range) readily fail in dma_map_page(), and __xe_svm_handle_pagefault() turns the resulting -EFAULT into an unconditional \"goto retry\" while holding vm->lock for write, giving an unbounded retry loop; corrupting adjacent kernel memory via the stray DMA window likewise crashes the machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "99624bdff8670795b678eafa6509aaad3a5c0175", "lessThan": "08e9fd78ba1b9e95141181c69cc51795c9888157", "versionType": "git"}, {"status": "affected", "version": "99624bdff8670795b678eafa6509aaad3a5c0175", "lessThan": "c50729c68aaf93611c855752b00e49ce1fdd1558", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157"}, {"url": "https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: fix hmm_pfn_to_map_order() usage\n\nHandle the case where the hmm range partially covers a huge page (like\n2M), otherwise we can potentially end up doing something nasty like\nmapping memory which is outside the range, and maybe not even mapped by\nthe mm. Fix is based on the xe userptr code, which in a future patch\nwill directly use gpusvm, so needs alignment here.\n\nv2:\n - Add kernel-doc (Matt B)\n - s/fls/ilog2/ (Thomas)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.8", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:42.657Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40336", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:46.189Z", "dateReserved": "2025-04-16T07:20:57.186Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-09T04:09:52.845Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "08e9fd78ba1b9e95141181c69cc51795c9888157", "status": "affected", "version": "99624bdff8670795b678eafa6509aaad3a5c0175", "versionType": "git"}, {"lessThan": "c50729c68aaf93611c855752b00e49ce1fdd1558", "status": "affected", "version": "99624bdff8670795b678eafa6509aaad3a5c0175", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: fix hmm_pfn_to_map_order() usage\n\nHandle the case where the hmm range partially covers a huge page (like\n2M), otherwise we can potentially end up doing something nasty like\nmapping memory which is outside the range, and maybe not even mapped by\nthe mm. Fix is based on the xe userptr code, which in a future patch\nwill directly use gpusvm, so needs alignment here.\n\nv2:\n - Add kernel-doc (Matt B)\n - s/fls/ilog2/ (Thomas)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/gpusvm: corregir el uso de hmm_pfn_to_map_order()\n\nManejar el caso en que el rango hmm cubre parcialmente una p\u00e1gina enorme (como 2M), de lo contrario podemos potencialmente terminar haciendo algo desagradable como mapear memoria que est\u00e1 fuera del rango, y quiz\u00e1s ni siquiera mapeada por el mm. La correcci\u00f3n se basa en el c\u00f3digo xe userptr, que en un parche futuro usar\u00e1 directamente gpusvm, por lo que necesita alineaci\u00f3n aqu\u00ed.\n\nv2:\n - A\u00f1adir kernel-doc (Matt B)\n - s/fls/ilog2/ (Thomas)"}], "id": "CVE-2025-40336", "lastModified": "2026-10-15T22:19:08.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40336", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:59:29.236103Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:43.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/gpusvm: fix hmm_pfn_to_map_order() usage", "id": "2420416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420416"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40336", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40336\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40336\nhttps://lore.kernel.org/linux-cve-announce/2025120911-CVE-2025-40336-781e@gregkh/T"], "statement": "This vulnerability affects systems using GPU drivers that utilize the gpusvm subsystem for shared virtual memory between CPU and GPU. Exploitation requires local access and the ability to use GPU memory mapping features. The impact includes potential information disclosure or memory corruption.", "threat_severity": "Moderate"}

{}