In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix Use-after-free in validation
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmwexecbufprocess. All nodes are expected to be cleared in vmwvalidationdrop_ht but this node escaped because its resource was destroyed prematurely.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2025/40xxx/CVE-2025-40111.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"303560221194515539854360236634363832606",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1822e5287b7dfa59d0af966756ebf1dc652b60ee",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-29f09184",
"signature_version": "v1"
},
{
"digest": {
"length": 1249.0,
"function_hash": "232896175414663804172859971188327421592"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@867bda5d95d36f10da398fd4409e21c7002b2332",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-55ed977d",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"303560221194515539854360236634363832606",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c918f9d1ccccc0e092f43dcb2d8266f54d7340b",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-6a375e79",
"signature_version": "v1"
},
{
"digest": {
"length": 1320.0,
"function_hash": "77357077165231095281462767693043326575"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c918f9d1ccccc0e092f43dcb2d8266f54d7340b",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-831768fb",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"303560221194515539854360236634363832606",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7165e5f3b3b10721ff70553583ad12e90e447a",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-9b6c444d",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83852605296363912880065019051004388935",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@655a2f29bfc21105c80bf8a7d7aafa6eca8b4496",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-bd2be8dd",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83852605296363912880065019051004388935",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfe1323ab3c8a4dd5625ebfdba44dc47df84512a",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-bdd9d1a5",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83852605296363912880065019051004388935",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8eaca539708ca532747f606d231f70e684e8ca",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-ce43a6b2",
"signature_version": "v1"
},
{
"digest": {
"length": 1320.0,
"function_hash": "77357077165231095281462767693043326575"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb7165e5f3b3b10721ff70553583ad12e90e447a",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-d3f78bab",
"signature_version": "v1"
},
{
"digest": {
"length": 1320.0,
"function_hash": "77357077165231095281462767693043326575"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1822e5287b7dfa59d0af966756ebf1dc652b60ee",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-d8f34525",
"signature_version": "v1"
},
{
"digest": {
"length": 1249.0,
"function_hash": "232896175414663804172859971188327421592"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8eaca539708ca532747f606d231f70e684e8ca",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-dfb1cd61",
"signature_version": "v1"
},
{
"digest": {
"length": 1249.0,
"function_hash": "232896175414663804172859971188327421592"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfe1323ab3c8a4dd5625ebfdba44dc47df84512a",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-e2b80ee0",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83852605296363912880065019051004388935",
"188947084984345967762661204599728412644",
"202400031490408548542986165526936510826",
"47145161131421182814409840884636826300",
"160807680329591032100759793000396104223"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@867bda5d95d36f10da398fd4409e21c7002b2332",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-e3812662",
"signature_version": "v1"
},
{
"digest": {
"length": 1249.0,
"function_hash": "232896175414663804172859971188327421592"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@655a2f29bfc21105c80bf8a7d7aafa6eca8b4496",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "vmw_validation_add_resource",
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_validation.c"
},
"id": "CVE-2025-40111-fbdf817e",
"signature_version": "v1"
}
]