Skip to main content

Linux Kernel CVE-2025-40334

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.3
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
vuln.today AI
7.3 HIGH

Local GPU device access required (AV:L, PR:L); unvalidated VA enables out-of-bounds kernel memory read (C:H) and driver crash (A:H) with limited integrity impact (I:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:37 vuln.today
CVE Published
Dec 09, 2025 - 16:17 cve.org
HIGH 7.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate userq buffer virtual address and size

It needs to validate the userq object virtual address to determine whether it is residented in a valid vm mapping.

AnalysisAI

Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.

Technical ContextAI

The affected component is the amdgpu DRM (Direct Rendering Manager) kernel driver, which manages AMD Radeon/Instinct GPUs on Linux. Modern amdgpu exposes user queues (userq) that let userspace submit GPU work referencing buffer objects mapped into the GPU's per-process virtual address space (GPUVM). The defect is a missing validation step: before consuming a userq buffer, the driver did not verify that the supplied virtual address and size fall within a valid, currently-mapped VM range. This is a classic input-validation / bounds-checking weakness (conceptually CWE-20 Improper Input Validation combined with CWE-125 Out-of-Bounds Read; the input lists CWE as N/A), where trusting userspace-supplied addressing lets the kernel dereference memory outside the intended mapping. The fix adds explicit validation of the userq object's virtual address and size to ensure it is resident in a valid VM mapping.

Affected ProductsAI

The Linux kernel amdgpu driver is affected on builds that include the userq (user queue) submission path for AMD GPUs. No exact vulnerable version range or CPE string is provided in the source data; the two upstream references are stable-tree git commits at git.kernel.org (5a577de86c4a1c67ca405571d6ef84e65c6897d1 and 9e46b8bb0539d7bc9a9e7b3072fa4f6082490392), indicating the fix was backported to one or more stable kernel series. Systems with AMD GPUs running a kernel that includes amdgpu userqueue support are the practical exposure; exact affected/fixed kernel version numbers should be confirmed from the distribution changelog or the stable-tree tags containing these commits.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes commits 5a577de86c4a1c67ca405571d6ef84e65c6897d1 and 9e46b8bb0539d7bc9a9e7b3072fa4f6082490392 (https://git.kernel.org/stable/c/5a577de86c4a1c67ca405571d6ef84e65c6897d1 and https://git.kernel.org/stable/c/9e46b8bb0539d7bc9a9e7b3072fa4f6082490392), which add validation of the userq buffer virtual address and size. Track your distribution's security advisory for the exact patched package version rather than building from these commits directly. As a compensating control on multi-tenant or untrusted-local hosts where patching must wait, restrict access to the GPU render/DRM device nodes by tightening permissions and group membership on /dev/dri/render* and /dev/dri/card* so untrusted users and containers cannot submit GPU work - the trade-off is that this breaks legitimate GPU-accelerated workloads (compute, rendering, ML) for those users. Also avoid exposing GPU passthrough to untrusted VMs or containers until patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40334 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy