CVE-2025-40311

Vulnerability

In the Linux kernel's accel/habanalabs driver, when the IOMMU is enabled, dma_alloc_coherent() with GFP_USER can return memory addresses from the vmalloc range. If such an address is mapped into a user-space VMA without the VM_MIXEDMAP flag, the subsequent vm_insert_page() call triggers a BUG_ON due to the VM_PFNMAP restriction, causing a kernel crash [1].

Exploitation

An attacker with local access and the ability to trigger the vulnerable code path (e.g., by submitting a command buffer that leads to a mapping operation) could cause a denial of service by crashing the kernel. No special privileges beyond the ability to interact with the habanalabs device are required, but the IOMMU must be enabled for the condition to occur [1].

Impact

Successful exploitation results in a kernel panic (BUG_ON), leading to a system crash and denial of service. The memory remains driver-allocated and cannot be directly accessed by userspace, so no data leak or privilege escalation is expected [1].

Mitigation

The fix, introduced in kernel commits [1] and [2], adds a check for vmalloc addresses and sets the VM_MIXEDMAP flag in the VMA before mapping. This ensures safe mapping and avoids the BUG_ON. Users should apply the latest stable kernel updates containing this patch.