CVE-2025-40086

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-40086
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40086.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40086
Downstream
Published
2025-10-30T09:47:56Z
Modified
2025-10-30T20:57:18.022623Z
Summary
drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't allow evicting of BOs in same VM in array of VM binds

An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allowresevict flag in the xebovalidate call.

v2: - Invert polarity of noresevict (Thomas) - Add comment in code explaining issue (Thomas)

(cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dd08ebf6c3525a7ea2186e636df064ea47281987
Fixed
5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dd08ebf6c3525a7ea2186e636df064ea47281987
Fixed
7ac74613e5f2ef3450f44fd2127198662c2563a9

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.16
v6.16-rc1
v6.16-rc2
v6.16-rc3
v6.16-rc4
v6.16-rc5
v6.16-rc6
v6.16-rc7
v6.17
v6.17-rc1
v6.17-rc2
v6.17-rc3
v6.17-rc4
v6.17-rc5
v6.17-rc6
v6.17-rc7
v6.17.1
v6.17.2
v6.17.3
v6.17.4
v6.18-rc1
v6.7
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-40086-2a1c48a0",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "314893536800396175684309927733464458711",
            "length": 453.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "vm_bind_ioctl_ops_lock_and_prep"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ac74613e5f2ef3450f44fd2127198662c2563a9"
    },
    {
        "id": "CVE-2025-40086-65ca85e4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "12595814751271416018796539092985708583",
                "3421905982961256801818143071558173214",
                "63890572236398386152000730845549885323",
                "142623611141255437861400485935647012303",
                "214158701101572129636925361559465697441",
                "174949636231012025501027932052441376204",
                "10910249623905753678303351844023274433",
                "10600186436362444627652024093944124946",
                "65331556396340574602415928821678479846",
                "277033673703438390551677364597691003101",
                "320521693387482529145139807130844806419",
                "64150900718329848940289378528219324256",
                "251997103470701329979271602000916056054",
                "51008626522711522512848461939414770958",
                "178238699337750449592142425732652806892",
                "241633368013192934701216743309555887734",
                "102459576557468414846883660209045514908",
                "88157150664802763819067616321820443760",
                "125251308741866606514558774034385385084",
                "264523952177685365312138323728187041965",
                "122329981835780040010244298120551840093",
                "91610164265718233255597902334632139203",
                "182700615223793470171974484431064808211",
                "298338849074115471136435689419978013352",
                "176792258423933825515650111351413983022",
                "23649777334759318742852143957206207672",
                "288910385760412466614599307592971498140",
                "45704175434750409909751558802573308873",
                "131850890043758735232104952493753015891",
                "281661229544139339051227995543156383663",
                "211346464330034505792339722775122062457",
                "299109486853920624542065314989876812819",
                "30176158888116050046096699033433542158",
                "168119281929632076679244756134564320482",
                "223071968815435105596600777016179199571",
                "268668139638309489435223818384393339447",
                "124593949297169641144077623846874806470",
                "228660492320529138259948076835251005800",
                "197375164112620328633210009128704102668",
                "50446397455746197264352008830041110859",
                "108836663292937756210285831333006221952",
                "259111130868845165602925980108999266392"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ac74613e5f2ef3450f44fd2127198662c2563a9"
    },
    {
        "id": "CVE-2025-40086-6811ef46",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "334593584227543052543336011971752280370",
            "length": 4592.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "xe_vm_bind_ioctl"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
    },
    {
        "id": "CVE-2025-40086-8a27b10f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "249636538430432833393470679384062792562",
            "length": 4619.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "xe_vm_bind_ioctl"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ac74613e5f2ef3450f44fd2127198662c2563a9"
    },
    {
        "id": "CVE-2025-40086-8bc533a5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "314893536800396175684309927733464458711",
            "length": 453.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "vm_bind_ioctl_ops_lock_and_prep"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
    },
    {
        "id": "CVE-2025-40086-99bd2ed2",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "257924401624377573294300440888454833599",
            "length": 330.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "vma_lock_and_validate"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
    },
    {
        "id": "CVE-2025-40086-a0d272b9",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "59638177364204888607532572233140154176",
            "length": 1431.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "op_lock_and_prep"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
    },
    {
        "id": "CVE-2025-40086-c3c2af7e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "203459998293528780209079005387094225046",
            "length": 338.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "vma_lock_and_validate"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ac74613e5f2ef3450f44fd2127198662c2563a9"
    },
    {
        "id": "CVE-2025-40086-d56bcdcd",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "12595814751271416018796539092985708583",
                "3421905982961256801818143071558173214",
                "63890572236398386152000730845549885323",
                "142623611141255437861400485935647012303",
                "268908628849683528841545104221945932256",
                "332983635615365563961580926804323050102",
                "272502512407895016655579101134340514321",
                "331293089276122080539448413246963675005",
                "65331556396340574602415928821678479846",
                "277033673703438390551677364597691003101",
                "320521693387482529145139807130844806419",
                "64150900718329848940289378528219324256",
                "251997103470701329979271602000916056054",
                "51008626522711522512848461939414770958",
                "178238699337750449592142425732652806892",
                "241633368013192934701216743309555887734",
                "102459576557468414846883660209045514908",
                "88157150664802763819067616321820443760",
                "125251308741866606514558774034385385084",
                "264523952177685365312138323728187041965",
                "122329981835780040010244298120551840093",
                "91610164265718233255597902334632139203",
                "182700615223793470171974484431064808211",
                "298338849074115471136435689419978013352",
                "176792258423933825515650111351413983022",
                "23649777334759318742852143957206207672",
                "288910385760412466614599307592971498140",
                "45704175434750409909751558802573308873",
                "131850890043758735232104952493753015891",
                "281661229544139339051227995543156383663",
                "12699341749397769584277906640780814975",
                "299109486853920624542065314989876812819",
                "30176158888116050046096699033433542158",
                "289694974084552796238729742005063232240",
                "223071968815435105596600777016179199571",
                "268668139638309489435223818384393339447",
                "124593949297169641144077623846874806470",
                "228660492320529138259948076835251005800",
                "197375164112620328633210009128704102668",
                "50446397455746197264352008830041110859",
                "108836663292937756210285831333006221952",
                "259111130868845165602925980108999266392"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
    },
    {
        "id": "CVE-2025-40086-d9cb93b6",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "191285128557837080666788705000667520241",
            "length": 1454.0
        },
        "target": {
            "file": "drivers/gpu/drm/xe/xe_vm.c",
            "function": "op_lock_and_prep"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ac74613e5f2ef3450f44fd2127198662c2563a9"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.17.5