Skip to main content

Linux Kernel CVE-2025-40111

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Reaching the vmwgfx DRM ioctl needs an unprivileged local account (AV:L, PR:L), the use-after-free is deterministic (AC:L), and kernel compromise yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Red Hat
5.8 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 09:20 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:19 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 02:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix Use-after-free in validation

Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.

AnalysisAI

Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.

Technical ContextAI

The affected component is vmwgfx, the DRM/KMS kernel driver for VMware's virtual SVGA/GPU device, loaded inside Linux guests running on VMware (ESXi/Workstation/Fusion). The bug lives in the graphics command-submission path (vmw_execbuf_process), which validates the GPU resources referenced by a userspace-submitted command buffer. Validation bookkeeping uses an arena allocator whose memory is freed in bulk at the end of execbuf processing, while per-resource nodes are tracked in a 'duplicates' hashtable that vmw_validation_drop_ht is expected to empty. The root-cause class is a use-after-free (CWE-416, though the input lists CWE as N/A): a resource is torn down before its validation node is removed from the hashtable, so the node - and the freed arena memory it points to - can be referenced after free. Such stale kernel-object references are a classic building block for controlled memory corruption.

Affected ProductsAI

The Linux kernel's vmwgfx DRM driver is affected. Exact vulnerable version ranges are not enumerated in the provided NVD data (no CPE strings were supplied and CWE is N/A), and the eight git.kernel.org/stable/c/ commit links indicate the fix was backported across multiple stable branches, implying a range of kernel versions is affected until each branch's patched build. For distribution-specific affected and fixed versions, consult Ubuntu advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1), plus the VulDB entry https://vuldb.com/vuln/332054. Only Linux guests running on VMware hypervisors with the vmwgfx driver loaded are practically exposed.

RemediationAI

Patch available per vendor advisory: update to a fixed kernel build. The upstream fix is committed to the stable tree (see git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee and the other seven stable commits), and distributions have shipped fixed packages - apply the Ubuntu kernel updates in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1), then reboot to load the patched kernel. Because the exact fixed upstream tag is not stated in the input, rely on your distribution's patched version rather than an invented number. Where patching must be deferred, unload or blacklist the vmwgfx module if the guest does not need accelerated graphics (blacklist vmwgfx via modprobe and fall back to a generic/framebuffer display), which removes the vulnerable code path at the cost of losing 3D/2D acceleration and DRM/KMS features; alternatively restrict access to the /dev/dri card/render nodes to trusted users only, limiting who can reach the execbuf ioctl but breaking GPU/graphical workloads for restricted accounts.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40111 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy