{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40340","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.187Z","datePublished":"2025-12-09T04:09:57.059Z","dateUpdated":"2026-05-11T21:47:28.456Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T21:47:28.456Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel without debug options enabled.\n\nThe panic happens after core_hotunplug unbind-rebind finishes.\nPresumably what happens is that a process mmaps, unlocks because\nof the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,\ncausing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since\nthere was nothing left to populate, and then oopses in\n\"mem_type_is_vram(tbo->resource->mem_type)\" because tbo->resource\nis NULL.\n\nIt's convoluted, but fits the data and explains the oops after\nthe test exits."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"],"versions":[{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"99428bd6123d5676209dfb1d7a8f176cc830b665","status":"affected","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"29a3064f9c5a908aaf0b39cd6ed30374db11840d","status":"affected","versionType":"git"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"1cda3c755bb7770be07d75949bb0f45fb88651f6","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_bo.c"],"versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","status":"unaffected","versionType":"semver"},{"version":"6.12.58","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.8","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665"},{"url":"https://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d"},{"url":"https://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6"}],"title":"drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.","x_generator":{"engine":"bippy-1.2.0"}}}}