CVE-2025-40329

Vulnerability

Analysis

The Linux kernel's DRM scheduler contains a deadlock vulnerability in the function drm_sched_entity_kill_jobs_cb. The issue arises from a lock ordering conflict between the xarray lock (xa_lock) used for job dependencies and the fence lock (fence->lock) used in DMA fence operations. The function does not disable interrupts when accessing the xarray, creating a scenario where an interrupt context (CPU1) holding fence->lock attempts to acquire xa_lock, while another context (CPU0) already holds xa_lock and later attempts to acquire fence->lock in an interrupt, leading to a deadlock.

Exploitation

Context

The deadlock can be triggered when drm_sched_entity_kill_jobs_cb is invoked as a fence signaling callback, placing it in an interrupt context. Any code path that accesses job dependencies via xarray functions without disabling interrupts (e.g., drm_sched_job_add_dependency, drm_sched_entity_kill_jobs_cb) can participate in the deadlock. Additionally, a nested lock issue exists because dma_fence_signal locks the fence's lock, and dma_fence_add_callback also locks a fence lock; if the same spinlock is used for different fences, a deadlock occurs when iterating dependencies and re-arming callbacks.

Impact and

Mitigation

An attacker able to trigger the affected code path could cause a system hang or denial of service due to the deadlock. The fix, as described in the commit message, moves the dependency iteration and re-arming logic to a workqueue (drm_sched_entity_kill_jobs_work), separating it from the interrupt context and eliminating both locking issues. The patch has been applied to the Linux kernel stable tree, and users are advised to update to the latest kernel version.