CVE-2025-40191: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40191 was disclosed on November 12, 2025, affecting the Linux kernel. The vulnerability involves a process reference leak in the drm/amdkfd subsystem when unmapping userptr. Specifically, the issue occurs when kfd_lookup_process_by_pid is called as a function parameter, which can leak the kfd process refcount and miss NULL pointer checks if the application process is already destroyed (NVD, Ubuntu).

The vulnerability exists in the kernel's AMD Kernel Fusion Driver (AMDKFD) component, specifically in the userptr unmapping functionality. The issue stems from improper reference counting when kfd_lookup_process_by_pid is used as a function parameter, which can lead to a process reference leak. The vulnerability can result in missing NULL pointer checks when an application process has been destroyed (NVD).

The vulnerability could potentially lead to memory leaks in the kernel, which may result in resource exhaustion over time. Additionally, the missing NULL pointer checks could potentially lead to system instability or crashes when attempting to access already destroyed processes (NVD).

The vulnerability has been fixed in various Linux distributions. Ubuntu has marked this as a medium priority issue and has provided fixes for affected systems. Several kernel versions have been patched to address this vulnerability (Ubuntu).