CVE-2025-40096 (GCVE-0-2025-40096)

Vulnerability from cvelistv5 – Published: 2025-10-30 09:48 – Updated: 2026-08-05 12:07
VLAI
Title
drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 19:41 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7061 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 963d0b3569354230f6e2c36a286ef270a8901878 , < 4c38a63ae12ecc9370a7678077bde2d61aa80e9c (git)
Affected: 963d0b3569354230f6e2c36a286ef270a8901878 , < 57239762aa90ad768dac055021f27705dae73344 (git)
Affected: 963d0b3569354230f6e2c36a286ef270a8901878 , < e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11 (git)
Affected: 963d0b3569354230f6e2c36a286ef270a8901878 , < fdfb47e85af1e11ec822c82739dde2dd8dff5115 (git)
Affected: 963d0b3569354230f6e2c36a286ef270a8901878 , < 5801e65206b065b0b2af032f7f1eef222aa2fd83 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.158 , ≤ 6.1.* (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.5 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40096",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:41:41.321644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:41:52.101Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/scheduler/sched_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "57239762aa90ad768dac055021f27705dae73344",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "fdfb47e85af1e11ec822c82739dde2dd8dff5115",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "5801e65206b065b0b2af032f7f1eef222aa2fd83",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/scheduler/sched_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u003c fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u003c fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0027i\u0027 the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through GPU job-submission ioctls (MSM_GEM_SUBMIT, PANFROST_SUBMIT, AMDGPU_CS, xe/v3d/lima/etnaviv/pvr equivalents) on a local DRM render node. There is no network or remote-peer path into drm_sched_job_add_resv_dependencies().\nAC:L - The double put fires on the xa_alloc() -ENOMEM path, which the attacker can steer by sustaining memory pressure and by submitting jobs with many BOs/fences to force many xarray node allocations. Failed attempts merely return -ENOMEM to userspace, so the ioctl can be retried in a tight loop until the allocation fails, making the trigger attacker-influenced and repeatable rather than a condition outside their control.\nPR:L - All calling ioctls are marked DRM_RENDER_ALLOW with no capability check, so an ordinary unprivileged process holding an fd on /dev/dri/renderD128 suffices \u2014 every Android app, every Chrome OS sandboxed GPU client, and any desktop user in the render/video group. No root or CAP_SYS_ADMIN is needed.\nUI:N - The attacker submits its own GPU jobs against its own buffer objects; no victim action, mount, or file open is required. Exploitation is fully self-contained in the attacking process.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority \u2014 a standard local kernel memory-safety issue with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The extra dma_fence_put() frees a fence still referenced by the BO\u0027s dma_resv, the scheduler, and other jobs\u0027 dependency arrays, giving a use-after-free on a slab object (drm_sched_fence has its own kmem_cache). Reclaiming that memory with attacker-controlled data allows disclosure of kernel memory contents via the stale fence dereferences.\nI:H - The freed dma_fence is subsequently dereferenced through its ops table (-\u003esignaled, -\u003ewait, -\u003erelease) and its dma_fence_cb callback list, both of which are function pointers in the freed allocation. Heap grooming of the reclaimed object therefore yields a write/control-flow-hijack primitive, i.e. potential privilege escalation.\nA:H - Even without successful grooming, the refcount underflow and premature free cause use-after-free dereferences in the GPU scheduler, producing an oops/panic or GPU-wide hang. Any kernel crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:47.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115"
        },
        {
          "url": "https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83"
        }
      ],
      "title": "drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40096",
    "datePublished": "2025-10-30T09:48:03.954Z",
    "dateReserved": "2025-04-16T07:20:57.163Z",
    "dateUpdated": "2026-08-05T12:07:47.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40096",
      "date": "2026-10-23",
      "epss": "0.00154",
      "percentile": "0.04169"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-07T01:44:30.000Z",
      "cve": "CVE-2025-40096",
      "id": "msrc_CVE-2025-40096",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40096.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/scheduler/sched_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
                    "status": "affected",
                    "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57239762aa90ad768dac055021f27705dae73344",
                    "status": "affected",
                    "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
                    "status": "affected",
                    "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fdfb47e85af1e11ec822c82739dde2dd8dff5115",
                    "status": "affected",
                    "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5801e65206b065b0b2af032f7f1eef222aa2fd83",
                    "status": "affected",
                    "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/scheduler/sched_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u003c fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u003c fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0027i\u0027 the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/sched: Corrige una posible doble liberaci\u00f3n en drm_sched_job_add_resv_dependencies\n\nAl a\u00f1adir dependencias con drm_sched_job_add_dependency(), esa funci\u00f3n consume la referencia de la valla tanto en caso de \u00e9xito como de fallo, por lo que en este \u00faltimo caso el dma_fence_put() en la ruta de error (xarray no pudo expandirse) es una doble liberaci\u00f3n.\n\nCuriosamente, este error parece haber estado presente desde el commit ebd5f74255b9 (\u0027drm/sched: Add dependency tracking\u0027), ya que el c\u00f3digo en aquel entonces se ve\u00eda as\u00ed:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u003c fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u003c fence_count; i++)\n               dma_fence_put(fences[i]);\n\nLo que significa que para la \u0027i\u0027 fallida el dma_fence_put ya era una doble liberaci\u00f3n. Posiblemente no hab\u00eda usuarios en ese momento, o los casos de prueba eran insuficientes para detectarlo.\n\nEl error fue entonces solo notado y corregido despu\u00e9s de que el commit 9c2ba265352a (\u0027drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\u0027) aterrizara, con su correcci\u00f3n del commit 4eaf02d6076c (\u0027drm/scheduler: fix drm_sched_job_add_implicit_dependencies\u0027).\n\nEn ese momento era una variante ligeramente diferente de una doble liberaci\u00f3n, que el commit 963d0b356935 (\u0027drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\u0027) not\u00f3 e intent\u00f3 corregir.\n\nPero solo movi\u00f3 la doble liberaci\u00f3n de ocurrir dentro de drm_sched_job_add_dependency(), al liberar la referencia a\u00fan no obtenida, al llamador, al liberar la referencia ya liberada por el primero en el caso de fallo.\n\nComo tal, no es f\u00e1cil identificar el objetivo correcto para la etiqueta de correcciones, as\u00ed que manteng\u00e1moslo simple y simplemente continuemos la cadena.\n\nMientras corregimos, tambi\u00e9n mejoramos el comentario y explicamos la raz\u00f3n para tomar la referencia y no soltarla."
          }
        ],
        "id": "CVE-2025-40096",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40096",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:41:41.321644Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-30T10:15:34.080",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:47:42+00:00",
      "cve": "CVE-2025-40096",
      "id": "CVE-2025-40096",
      "initial_release_date": "2025-10-30T00:00:00+00:00",
      "product_status:fixed": "1868",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "100",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40096.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-40096",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T19:41:41.321644Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T19:41:46.937Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/scheduler/sched_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
                  "status": "affected",
                  "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                  "versionType": "git"
                },
                {
                  "lessThan": "57239762aa90ad768dac055021f27705dae73344",
                  "status": "affected",
                  "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                  "versionType": "git"
                },
                {
                  "lessThan": "e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
                  "status": "affected",
                  "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                  "versionType": "git"
                },
                {
                  "lessThan": "fdfb47e85af1e11ec822c82739dde2dd8dff5115",
                  "status": "affected",
                  "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                  "versionType": "git"
                },
                {
                  "lessThan": "5801e65206b065b0b2af032f7f1eef222aa2fd83",
                  "status": "affected",
                  "version": "963d0b3569354230f6e2c36a286ef270a8901878",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/scheduler/sched_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.16"
                },
                {
                  "lessThan": "5.16",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.158",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.114",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.55",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.17.*",
                  "status": "unaffected",
                  "version": "6.17.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.18",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.158",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.114",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.55",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17.5",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u003c fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u003c fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0027i\u0027 the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code is reached only through GPU job-submission ioctls (MSM_GEM_SUBMIT, PANFROST_SUBMIT, AMDGPU_CS, xe/v3d/lima/etnaviv/pvr equivalents) on a local DRM render node. There is no network or remote-peer path into drm_sched_job_add_resv_dependencies().\nAC:L - The double put fires on the xa_alloc() -ENOMEM path, which the attacker can steer by sustaining memory pressure and by submitting jobs with many BOs/fences to force many xarray node allocations. Failed attempts merely return -ENOMEM to userspace, so the ioctl can be retried in a tight loop until the allocation fails, making the trigger attacker-influenced and repeatable rather than a condition outside their control.\nPR:L - All calling ioctls are marked DRM_RENDER_ALLOW with no capability check, so an ordinary unprivileged process holding an fd on /dev/dri/renderD128 suffices \u2014 every Android app, every Chrome OS sandboxed GPU client, and any desktop user in the render/video group. No root or CAP_SYS_ADMIN is needed.\nUI:N - The attacker submits its own GPU jobs against its own buffer objects; no victim action, mount, or file open is required. Exploitation is fully self-contained in the attacking process.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority \u2014 a standard local kernel memory-safety issue with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The extra dma_fence_put() frees a fence still referenced by the BO\u0027s dma_resv, the scheduler, and other jobs\u0027 dependency arrays, giving a use-after-free on a slab object (drm_sched_fence has its own kmem_cache). Reclaiming that memory with attacker-controlled data allows disclosure of kernel memory contents via the stale fence dereferences.\nI:H - The freed dma_fence is subsequently dereferenced through its ops table (-\u003esignaled, -\u003ewait, -\u003erelease) and its dma_fence_cb callback list, both of which are function pointers in the freed allocation. Heap grooming of the reclaimed object therefore yields a write/control-flow-hijack primitive, i.e. potential privilege escalation.\nA:H - Even without successful grooming, the refcount underflow and premature free cause use-after-free dereferences in the GPU scheduler, producing an oops/panic or GPU-wide hang. Any kernel crash is High availability impact."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:07:47.604Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c"
            },
            {
              "url": "https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344"
            },
            {
              "url": "https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11"
            },
            {
              "url": "https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115"
            },
            {
              "url": "https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83"
            }
          ],
          "title": "drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-40096",
        "datePublished": "2025-10-30T09:48:03.954Z",
        "dateReserved": "2025-04-16T07:20:57.163Z",
        "dateUpdated": "2026-08-05T12:07:47.604Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.