Riskcovery

CVE-2025-40340

drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

State
Published
Severity
Not scored
Published
Dec 9, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options enabled.

The panic happens after core_hotunplug unbind-rebind finishes. Presumably what happens is that a process mmaps, unlocks because of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left, causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since there was nothing left to populate, and then oopses in "mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource is NULL.

It's convoluted, but fits the data and explains the oops after the test exits.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 99428bd6123d5676209dfb1d7a8f176cc830b665Affected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 29a3064f9c5a908aaf0b39cd6ed30374db11840dAffected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 1cda3c755bb7770be07d75949bb0f45fb88651f6Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.58 through 6.12.*Not affected
  • 6.17.8 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.