CVE-2025-40191: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40191 is a reference count (refcount) leak vulnerability in the Linux kernel's drm/amdkfd subsystem, specifically triggered during userptr unmapping operations. The flaw occurs because kfd_lookup_process_by_pid is called as a function parameter, causing the kfd process reference count to leak and missing the NULL pointer check when the application process has already been destroyed. It was published on November 12, 2025, and affects Linux kernel versions in the range starting from commit 2d274bf7099bc5e95fabaa93f23d0eb2977187ad, with fixes backported to stable branches and included in kernel 6.18-rc1 and 6.17.4. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, EUVD).

The root cause is an improper reference count management (related to CWE-911: Improper Update of Reference Count) in the AMD KFD (Kernel Fusion Driver) component of the Linux DRM subsystem. When kfd_lookup_process_by_pid is passed directly as a function argument, the returned reference is not properly stored and released, causing a refcount leak. Additionally, this calling pattern bypasses the necessary NULL pointer check, meaning that if the application process has already been destroyed at the time of the call, a NULL dereference can occur during userptr unmapping — potentially leading to a kernel crash. The fix involves storing the result of kfd_lookup_process_by_pid in a local variable, performing the NULL check, and ensuring the reference is properly decremented after use (Feedly, kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability can result in a kernel NULL pointer dereference or reference count exhaustion, leading to a system crash (denial of service). Because the affected code path is in the AMD GPU kernel driver (drm/amdkfd), systems with AMD GPUs running affected kernel versions are at risk of kernel panics during GPU memory management operations involving userptr unmapping. There is no evidence of confidentiality or integrity impact beyond availability loss; lateral movement or data exfiltration are not expected outcomes of this vulnerability (Feedly, EUVD).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2025-40191. The EPSS score is extremely low at 0.000180, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with an AMD GPU and the ability to trigger userptr unmapping operations under specific race conditions (Feedly).

The vulnerability is fixed in Linux kernel 6.18-rc1 and 6.17.4, with patches also backported to stable branches (commits 60f6112fc9b3 and 58e6fc2fb94f). Users should update to a patched kernel version as soon as it is available from their Linux distribution. As a temporary workaround, systems without AMD GPUs or those not using the amdkfd driver are not affected and can unload or blacklist the amdkfd kernel module to reduce exposure (kernel.org patch 1, kernel.org patch 2, EUVD).