Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-40111

drm/vmwgfx: Fix Use-after-free in validation

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 1822e5287b7dfa59d0af966756ebf1dc652b60ee; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in fb7165e5f3b3b10721ff70553583ad12e90e447a; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 4c918f9d1ccccc0e092f43dcb2d8266f54d7340b; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 9a8eaca539708ca532747f606d231f70e684e8ca; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 867bda5d95d36f10da398fd4409e21c7002b2332; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 655a2f29bfc21105c80bf8a7d7aafa6eca8b4496; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in 65608e991c2d771c13404e5c7ae122ac3c3357a4; From 64ad2abfe9a628ce79859d072704bd1ef7682044 · fixed in dfe1323ab3c8a4dd5625ebfdba44dc47df84512a

  • Linux Linux

    4.20

  • KernelLinux

    From 4.20.0 · fixed in 5.4.301; From 5.5.0 · fixed in 5.10.246; From 5.11.0 · fixed in 5.15.195; From 5.16.0 · fixed in 6.1.157; From 6.2.0 · fixed in 6.6.113; From 6.7.0 · fixed in 6.12.54; From 6.13.0 · fixed in 6.17.4

References 8

git.kernel.org