{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8355eea2a2e9c323021dfdcb95d7767d382123c4",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "7a12f9c96d06b145562f76ffb20369b4692f0911",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "576c930e5e7dcb937648490611a83f1bf0171048",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Flush shmem writes before mapping buffers CPU-uncached\n\nThe shmem layer zeroes out the new pages using cached mappings, and if\nwe don\u0027t CPU-flush we might leave dirty cachelines behind, leading to\npotential data leaks and/or asynchronous buffer corruption when dirty\ncachelines are evicted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the DRM render node (`/dev/dri/renderD*`) via the PANTHOR_BO_CREATE / BO_MMAP_OFFSET ioctls and a subsequent mmap(). There is no remote or adjacent-network path to panthor GEM allocation.\nAC:L - The mechanism is deterministic, not a race: on non-coherent arm64 SoCs (all real panthor platforms) the zeroing is never flushed, so a WC mapping reliably reads stale DRAM, and the write-back clobber can be forced on demand by triggering `dma_map_sgtable()` via VM_BIND. No memory-layout grooming or timing window outside the attacker\u0027s control is needed.\nPR:L - All required ioctls are marked DRM_RENDER_ALLOW, so no authentication, DRM master status, or capability is checked \u2014 only an open fd on the render node. That is available to any unprivileged local user on a graphics-enabled system and to every app on Android/embedded Mali devices.\nUI:N - The attacker performs every step itself \u2014 open the render node, create the BO, obtain the mmap offset, mmap and read. No victim action or cooperation is required.\nS:U - The disclosure and corruption occur within the kernel/GPU-driver security authority acting on behalf of the calling process; no VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - Reads through the uncached mapping return residual physical DRAM contents from pages recycled by the buddy allocator, which may hold freed kernel data, page-cache contents, other processes\u0027 memory, or key material. The leak is unbounded in volume and arbitrarily repeatable by allocating large BOs in a loop, amounting to a general physical-memory disclosure primitive.\nI:L - Stale dirty cachelines are written back over data placed in the buffer through the uncached mapping, silently corrupting GPU command streams, descriptors, and compute results. The corruption is real and attacker-triggerable but is confined to the buffer\u0027s own pages and its content is not attacker-chosen, so it is not an arbitrary cross-domain write.\nA:H - A corrupted command stream raises CS_FATAL/CS_UNRECOVERABLE or a progress timeout, both of which call `panthor_device_schedule_reset()` and force a device-wide GPU reset that destroys every context on the system, not just the attacker\u0027s. On the phone, automotive, and embedded devices panthor targets, the GPU drives the display, so a locally repeatable reset storm denies graphics service to all users."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:08.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8355eea2a2e9c323021dfdcb95d7767d382123c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a12f9c96d06b145562f76ffb20369b4692f0911"
        },
        {
          "url": "https://git.kernel.org/stable/c/576c930e5e7dcb937648490611a83f1bf0171048"
        }
      ],
      "title": "drm/panthor: Flush shmem writes before mapping buffers CPU-uncached",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40276",
    "datePublished": "2025-12-06T21:50:59.035Z",
    "dateReserved": "2025-04-16T07:20:57.184Z",
    "dateUpdated": "2026-08-05T12:09:08.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}