Skip to main content

Linux Kernel CVE-2025-40069

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.3 LOW

Local invocation of the GPU VM_BIND ioctl requires device access (AV:L/PR:L); a leaked object reference causes only gradual resource exhaustion, so C:N/I:N and A:L rather than the input's C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:47 vuln.today
CVE Published
Oct 28, 2025 - 12:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix obj leak in VM_BIND error path

If we fail a handle-lookup part way thru, we need to drop the already obtained obj references.

Patchwork: https://patchwork.freedesktop.org/patch/669784/

AnalysisAI

Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The affected component is drm/msm, the Direct Rendering Manager kernel driver for Qualcomm Adreno GPUs used in Android and ARM Linux systems. The bug is in the VM_BIND submission path, which lets userspace batch GPU virtual-address mapping/unmapping operations referencing multiple GEM (Graphics Execution Manager) buffer objects by handle. During processing the driver acquires references on each looked-up object; if a handle lookup fails midway, the error path returned without releasing the references already taken, leaking those object references (a refcount/resource leak). The CWE was marked N/A by the source, but the root-cause class is CWE-401 (Missing Release of Memory / reference after error) / CWE-772 (Missing Release of Resource), a classic kernel error-path cleanup omission.

Affected ProductsAI

The vulnerability affects the Linux kernel's drm/msm driver for Qualcomm Adreno GPUs, specifically kernel versions that include the MSM VM_BIND uAPI/error path. Exact affected version ranges are not enumerated in the provided data; the fix is delivered through the stable tree (see https://git.kernel.org/stable/c/278f8904434aa96055e793936b5977c010549e28 and https://git.kernel.org/stable/c/2b512909a291a964cfcf6b58de13256ab3e848c4) and the originating change at https://patchwork.freedesktop.org/patch/669784/. Deployment is limited to systems running Linux on Qualcomm/Adreno hardware (many Android devices and ARM SoC platforms); non-Qualcomm systems do not compile/run this driver path.

RemediationAI

Upstream fix available (stable commits 278f8904 and 2b512909); a released, independently confirmed tagged kernel version is not provided in the input, so update to the distribution or vendor kernel that incorporates these commits (references: https://git.kernel.org/stable/c/278f8904434aa96055e793936b5977c010549e28 and https://git.kernel.org/stable/c/2b512909a291a964cfcf6b58de13256ab3e848c4). For Android/SoC devices, apply the vendor/OEM kernel update that backports this patch. As a compensating control where patching is delayed, restrict access to the GPU render/DRM device nodes (e.g., limit /dev/dri render node permissions to trusted users/groups) to reduce who can invoke the VM_BIND ioctl; the trade-off is that this can break GPU-accelerated workloads for restricted users. No other clean workaround exists because the leak is inherent to the error path.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40069 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy