CVE-2025-40289

Vulnerability

In the Linux kernel's drm/amdgpu driver, sysfs attributes related to VRAM are created for all GPUs, including those without any VRAM. Accessing these attributes on a GPU without VRAM triggers a crash due to dereferencing a NULL or invalid pointer.

Exploitation

The attack surface is local: any unprivileged user with access to the sysfs filesystem can trigger the crash by reading a VRAM sysfs file on a VRAM-less GPU. No special privileges or authentication are required beyond the ability to traverse sysfs.

Impact

Successful exploitation results in a denial of service, causing the kernel to crash and potentially requiring a system reboot. The vulnerability does not lead to privilege escalation or data corruption.

Mitigation

The fix hides the VRAM sysfs attributes for GPUs without VRAM, preventing the crash. Patches have been applied to stable kernel trees as referenced in commits [1], [2], [3]. Users should update their kernels to include these fixes.