CVE-2025-40086

Vulnerability

In the Linux kernel's drm/xe driver, an array of VM binds can potentially evict other buffer objects (BOs) within the same VM under the same VM under certain conditions. This eviction may lead to NULL pointer dereferences later in the bind pipeline [1].

Exploitation

The issue occurs when processing an array of VM binds, where the driver may attempt to evict BOs that are part of the same VM. This can happen without proper validation, leading to a use-after-free or NULL pointer scenario. No special privileges are required beyond local access to trigger the bind operation [1].

Impact

An attacker with local access could exploit this to cause a NULL pointer dereference, resulting in a system crash (denial of service). The vulnerability does not appear to allow privilege escalation or code execution based on the available information [1].

Mitigation

The fix clears the allow_res_evict flag in the xe_bo_validate call to prevent eviction of BOs within the same VM. The patch has been applied to the stable kernel tree and is included in commit 8b9ba8d6d95fe [1]. Users should update to the latest kernel version.