CVE-2025-40157: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's EDAC (Error Detection and Correction) driver for Intel Granite Rapids servers, identified as CVE-2025-40157. The issue was disclosed on November 12, 2025, affecting the i10nm_edac driver when handling disabled memory controllers (NVD).

The vulnerability occurs when loading the i10nmedac driver on Intel Granite Rapids servers. The issue manifests when a BIOS disables a memory controller due to unpopulated memory DIMMs. In such cases, the DIMMMTR register of the disabled memory controller contains an invalid value (~0), resulting in a shift-out-of-bounds error in drivers/edac/skxcommon.c:453:16 with a negative shift exponent of -66 (NVD).

The vulnerability results in a call trace in the system logs and potential system instability when using the i10nm_edac driver on affected Intel Granite Rapids servers (NVD).

The issue has been resolved by implementing a fix that skips DIMM enumeration on disabled memory controllers. Multiple Linux distributions have released patched versions, including Ubuntu which has updated various kernel packages across different versions (24.04 LTS and 25.04) (Ubuntu Notice).