CVE-2025-40329
- Source
- https://cve.org/CVERecord?id=CVE-2025-40329
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40329.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40329
- Aliases
- Downstream
- Related
- Published
- 2025-12-09T04:09:46.156Z
- Modified
- 2026-02-09T18:56:32.113142Z
- Summary
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/sched: Fix deadlock in drmschedentitykilljobs_cb
The Mesa issue referenced below pointed out a possible deadlock:
[ 1231.611031] Possible interrupt unsafe locking scenario:
[ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xalock#17); [ 1231.611038] localirqdisable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xalock#17); [ 1231.611044] <Interrupt> [ 1231.611045] lock(&fence->lock); [ 1231.611047] * DEADLOCK *
In this example, CPU0 would be any function accessing job->dependencies through the xa* functions that don't disable interrupts (eg: drmschedjobadddependency(), drmschedentitykilljobscb()).
CPU1 is executing drmschedentitykilljobscb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xalock which is already held by CPU0.
Replacing all xa* usage by their xa*irq counterparts would fix this issue, but Christian pointed out another issue: dmafencesignal takes fence.lock and so does dmafenceaddcallback.
dmafencesignal() // locks f1.lock -> drmschedentitykilljobscb() -> foreach dependencies -> dmafenceaddcallback() // locks f2.lock
This will deadlock if f1 and f2 share the same spinlock.
To fix both issues, the code iterating on dependencies and re-arming them is moved out to drmschedentitykilljobs_work().
[phasta: commit message nits]
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40329.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0d63031ee4a57be0252cb9a4e09ae921c75cece9
- https://git.kernel.org/stable/c/3e8ada4fd838e3fd2cca94000dac054f3a347c01
- https://git.kernel.org/stable/c/487df8b698345dd5a91346335f05170ed5f29d4e
- https://git.kernel.org/stable/c/70150b9443dddf02157d821c68abf438f55a2e8e
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40329.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40329
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2fdb8a8f07c2f1353770a324fd19b8114e4329acFixed70150b9443dddf02157d821c68abf438f55a2e8eFixed0d63031ee4a57be0252cb9a4e09ae921c75cece9Fixed3e8ada4fd838e3fd2cca94000dac054f3a347c01Fixed487df8b698345dd5a91346335f05170ed5f29d4e