{"id":"CVE-2025-40340","state":"PUBLISHED","title":"drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel without debug options enabled.\n\nThe panic happens after core_hotunplug unbind-rebind finishes.\nPresumably what happens is that a process mmaps, unlocks because\nof the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,\ncausing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since\nthere was nothing left to populate, and then oopses in\n\"mem_type_is_vram(tbo->resource->mem_type)\" because tbo->resource\nis NULL.\n\nIt's convoluted, but fits the data and explains the oops after\nthe test exits.","publishedAt":"2025-12-09T04:09:57.059Z","updatedAt":"2026-05-11T21:47:28.456Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"99428bd6123d5676209dfb1d7a8f176cc830b665","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"29a3064f9c5a908aaf0b39cd6ed30374db11840d","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"1cda3c755bb7770be07d75949bb0f45fb88651f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"]}],"references":["https://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665","https://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d","https://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40340.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40340","state":"PUBLISHED","datePublished":"2025-12-09T04:09:57.059Z","dateUpdated":"2026-05-11T21:47:28.456Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.187Z"},"containers":{"cna":{"title":"drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel without debug options enabled.\n\nThe panic happens after core_hotunplug unbind-rebind finishes.\nPresumably what happens is that a process mmaps, unlocks because\nof the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,\ncausing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since\nthere was nothing left to populate, and then oopses in\n\"mem_type_is_vram(tbo->resource->mem_type)\" because tbo->resource\nis NULL.\n\nIt's convoluted, but fits the data and explains the oops after\nthe test exits."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"99428bd6123d5676209dfb1d7a8f176cc830b665","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"29a3064f9c5a908aaf0b39cd6ed30374db11840d","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","status":"affected","lessThan":"1cda3c755bb7770be07d75949bb0f45fb88651f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665"},{"url":"https://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d"},{"url":"https://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:47:28.456Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}