CVE-2025-40336 (GCVE-0-2025-40336)

Vulnerability from cvelistv5 – Published: 2025-12-09 04:09 – Updated: 2026-08-05 12:09
VLAI
Title
drm/gpusvm: fix hmm_pfn_to_map_order() usage
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas)
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 99624bdff8670795b678eafa6509aaad3a5c0175 , < 08e9fd78ba1b9e95141181c69cc51795c9888157 (git)
Affected: 99624bdff8670795b678eafa6509aaad3a5c0175 , < c50729c68aaf93611c855752b00e49ce1fdd1558 (git)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08e9fd78ba1b9e95141181c69cc51795c9888157",
              "status": "affected",
              "version": "99624bdff8670795b678eafa6509aaad3a5c0175",
              "versionType": "git"
            },
            {
              "lessThan": "c50729c68aaf93611c855752b00e49ce1fdd1558",
              "status": "affected",
              "version": "99624bdff8670795b678eafa6509aaad3a5c0175",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: fix hmm_pfn_to_map_order() usage\n\nHandle the case where the hmm range partially covers a huge page (like\n2M), otherwise we can potentially end up doing something nasty like\nmapping memory which is outside the range, and maybe not even mapped by\nthe mm. Fix is based on the xe userptr code, which in a future patch\nwill directly use gpusvm, so needs alignment here.\n\nv2:\n  - Add kernel-doc (Matt B)\n  - s/fls/ilog2/ (Thomas)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through DRM ioctls on the local render node /dev/dri/renderD* \u2014 DRM_IOCTL_XE_VM_CREATE with FAULT_MODE, VM_BIND of a CPU_ADDR_MIRROR range, then either a VM_BIND PREFETCH op or a GPU exec that faults. There is no network or remote-peer input on this path.\nAC:L - The attacker fully controls every precondition: it allocates the huge-page backing (madvise(MADV_HUGEPAGE) or hugetlbfs), and because drm_gpusvm_range_chunk_size() clamps the chunk to the caller-supplied xe_vma bounds, it can deterministically force a 4K/64K range inside a 2MB THP or a 2MB range at an arbitrary offset in a 1GB hugetlb page. No race, no memory-layout luck, and CONFIG_DRM_XE_GPUSVM defaults to y on every kernel that builds the xe driver.\nPR:L - Only an open file descriptor on the DRM render node is needed, which unprivileged local users hold via the render/video group, the logged-in-seat ACL, or a container with /dev/dri passed through. Neither xe_vm_create_ioctl() nor the VM_BIND/exec paths perform any capable() or CAP_SYS_* check.\nUI:N - The attacking process performs the whole sequence itself with its own ioctls and its own memory mappings. No other user or administrator has to mount, open, or interact with anything.\nS:C - The flaw makes the kernel program the IOMMU/DMA aperture for the GPU over physical memory outside the buffer the process owns, so the device is granted bidirectional DMA to memory that the DMA-isolation authority was supposed to withhold from it. The impacted resource lies beyond the security authority of the requesting process and of the driver that created the mapping, i.e. the DMA/IOMMU protection boundary is crossed.\nC:H - dma_map_page() is issued with PAGE_SIZE \u003c\u003c order bytes starting mid-huge-page, so up to ~2MB (THP) or ~1GB (1GB hugetlb) of physical memory belonging to the kernel or to other processes is made device-readable; the same over-sized size is passed to dma_map_resource() on the P2P device-private path. The attacker chooses the offset within the huge page, so it controls how much foreign memory is exposed.\nI:H - The mappings are created with DMA_BIDIRECTIONAL, so the out-of-range physical window is device-writable, and the GPU engines are programmable by the same unprivileged user. Attacker-influenced DMA writes into kernel slab, page tables, or other processes\u0027 pages is an arbitrary-write primitive.\nA:H - Over-sized mappings (up to 1GB of IOVA per range) readily fail in dma_map_page(), and __xe_svm_handle_pagefault() turns the resulting -EFAULT into an unconditional \"goto retry\" while holding vm-\u003elock for write, giving an unbounded retry loop; corrupting adjacent kernel memory via the stray DMA window likewise crashes the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:42.657Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157"
        },
        {
          "url": "https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558"
        }
      ],
      "title": "drm/gpusvm: fix hmm_pfn_to_map_order() usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40336",
    "datePublished": "2025-12-09T04:09:52.845Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-08-05T12:09:42.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40336",
      "date": "2026-08-05",
      "epss": "0.00152",
      "percentile": "0.04892"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40336\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:43.820\",\"lastModified\":\"2026-07-30T06:24:30.100\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/gpusvm: fix hmm_pfn_to_map_order() usage\\n\\nHandle the case where the hmm range partially covers a huge page (like\\n2M), otherwise we can potentially end up doing something nasty like\\nmapping memory which is outside the range, and maybe not even mapped by\\nthe mm. Fix is based on the xe userptr code, which in a future patch\\nwill directly use gpusvm, so needs alignment here.\\n\\nv2:\\n  - Add kernel-doc (Matt B)\\n  - s/fls/ilog2/ (Thomas)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_gpusvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"99624bdff8670795b678eafa6509aaad3a5c0175\",\"lessThan\":\"08e9fd78ba1b9e95141181c69cc51795c9888157\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99624bdff8670795b678eafa6509aaad3a5c0175\",\"lessThan\":\"c50729c68aaf93611c855752b00e49ce1fdd1558\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_gpusvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:38:26+00:00",
      "cve": "CVE-2025-40336",
      "id": "CVE-2025-40336",
      "initial_release_date": "2025-12-09T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/gpusvm: fix hmm_pfn_to_map_order() usage",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40336.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:01:36Z",
      "cve": "CVE-2025-40336",
      "id": "CVE-2025-40336",
      "initial_release_date": "2025-12-10T00:26:34Z",
      "product_status:known_not_affected": "448",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40336",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40336.json",
      "version": "18"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.