CVE-2025-40340
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options enabled. The panic happens after core_hotunplug unbind-rebind finishes. Presumably what happens is that a process mmaps, unlocks because of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left, causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since there was nothing left to populate, and then oopses in "mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource is NULL. It's convoluted, but fits the data and explains the oops after the test exits.
Affected versions
Linux kernel versions
6.8
and later are affected. Fixed in
6.12.58,
6.17.8,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40340 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6
-
PatchKernel patch commithttps://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d
-
PatchKernel patch commithttps://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665
Frequently asked questions
-
What is CVE-2025-40340?
CVE-2025-40340 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.8 onward and has been patched in 6.12.58, 6.17.8 and 6.18. CVE-2025-40340 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40340?
Yes — CVE-2025-40340 has been patched. Fixed versions include 6.12.58, 6.17.8 and 6.18. If you are running Linux kernel 6.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40340 actively exploited?
No — CVE-2025-40340 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.