CVE-2025-40340

Not scored yetLast modified Oct 14, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options enabled.

The panic happens after core_hotunplug unbind-rebind finishes. Presumably what happens is that a process mmaps, unlocks because of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left, causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since there was nothing left to populate, and then oopses in "mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource is NULL.

It's convoluted, but fits the data and explains the oops after the test exits.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= dd08ebf6c3525a7ea2186e636df064ea47281987, < 99428bd6123d5676209dfb1d7a8f176cc830b665; >= dd08ebf6c3525a7ea2186e636df064ea47281987, < 29a3064f9c5a908aaf0b39cd6ed30374db11840d; >= dd08ebf6c3525a7ea2186e636df064ea47281987, < 1cda3c755bb7770be07d75949bb0f45fb88651f6
LinuxLinux6.8

References

Timeline

Published
Dec 9, 2025
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40341In the Linux kernel, the following vulnerability has been resolved: futex: Don't leak robust_list pointer on exec race sys_get_robust_listCVE-2025-403428.8In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregisCVE-2025-403439.8In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association deletion twice When forcefully CVE-2025-403447.8In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_daCVE-2025-40345In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin CVE-2025-40346In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacityCVE-2025-403477.5In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix the deadlock of enetc_mdio_lock After applying the worCVE-2025-40348In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two compeCVE-2025-403497.8In the Linux kernel, the following vulnerability has been resolved: hfs: validate record offset in hfsplus_bmap_alloc hfsplus_bmap_alloc cCVE-2025-40354.3A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domaCVE-2025-403509.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for stridingCVE-2025-40351In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() The syzb
CVE-2025-40340: Unscored | Vulnix