Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-40336

Опубликовано: 09 дек. 2025
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2:

  • Add kernel-doc (Matt B)
  • s/fls/ilog2/ (Thomas)

    A flaw was found in the Linux kernel's GPU shared virtual memory (gpusvm) subsystem. When handling HMM (Heterogeneous Memory Management) ranges that partially cover a huge page (such as 2MB pages), the hmm_pfn_to_map_order() function may incorrectly map memory outside the intended range. This could result in mapping memory that is not mapped by the process's memory management, potentially exposing unauthorized memory regions or causing memory corruption.

Отчет

This vulnerability affects systems using GPU drivers that utilize the gpusvm subsystem for shared virtual memory between CPU and GPU. Exploitation requires local access and the ability to use GPU memory mapping features. The impact includes potential information disclosure or memory corruption.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10kernelFix deferred
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtNot affected
Red Hat Enterprise Linux 8kernelNot affected
Red Hat Enterprise Linux 8kernel-rtNot affected
Red Hat Enterprise Linux 9kernelFix deferred
Red Hat Enterprise Linux 9kernel-rtFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2420416kernel: drm/gpusvm: fix hmm_pfn_to_map_order() usage

EPSS

Процентиль: 8%
0.00027
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas)

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas)

msrc
4 месяца назад

drm/gpusvm: fix hmm_pfn_to_map_order() usage

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: d ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas)

EPSS

Процентиль: 8%
0.00027
Низкий

6.5 Medium

CVSS3