CVE-2025-40225: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40225 is a NULL pointer dereference vulnerability in the Linux kernel's DRM Panthor GPU driver that can cause a kernel panic. The flaw exists in the handling of partial unmapping of GPU virtual address (VA) regions via the VM_BIND interface. The Panthor driver incorrectly pre-allocates memory for only one new drm_gpuva structure during an unmap operation, but a partial unmap can require two, leading to a NULL pointer dereference. It was published on December 4, 2025, and affects the Linux kernel's drm/panthor subsystem (Feedly). The EPSS score is 0.022% (very low), and no CVSS score has been publicly assigned at this time.

The root cause is a NULL pointer dereference (CWE-476) in the drm/panthor driver's GPU virtual memory management layer (drm_gpuvm). When userspace issues a partial unmap of a GPU VA region via the VM_BIND interface, the driver pre-allocates memory for only one new drm_gpuva structure, but a partial unmap of an existing region can require splitting it into two new drm_gpuva entries (one for each remaining portion on either side of the unmapped range). When the second structure is needed but not allocated, a NULL pointer dereference occurs at virtual address 0x0000000000000078, triggering a kernel panic with an ARM64 Data Abort (ESR = 0x0000000096000046, FSC = level 2 translation fault) (Feedly). The fix involves correcting the pre-allocation logic to account for up to two new drm_gpuva structures during unmap operations, as committed to the stable kernel tree (Linux Kernel Git).

Successful exploitation of this vulnerability results in a kernel panic (system crash), causing a complete loss of availability for the affected system. The vulnerability can be triggered by a local, unprivileged userspace process that has access to the Panthor GPU device and uses the VM_BIND interface to perform a partial unmap of a GPU VA region. There is no evidence of confidentiality or integrity impact; the primary consequence is a denial-of-service condition via kernel crash (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40225. The vulnerability requires local access to a system with a Panthor-based GPU (ARM Mali GPU supported by the Panthor driver) and the ability to invoke the VM_BIND interface. The EPSS score is 0.022%, indicating a very low probability of exploitation in the near term (Feedly). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified.

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg output containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078 and references to the drm/panthor or drm_gpuvm subsystem.
• Logs: ARM64 Data Abort entries with ESR = 0x0000000096000046 and EC = 0x25: DABT (current EL) in kernel logs.
• Process: Unexpected system reboots or kernel panics on systems equipped with ARM Mali GPUs using the Panthor driver, particularly following GPU workloads that use the VM_BIND interface.

The fix has been committed to the Linux kernel stable tree via three patch commits: 4eabd0d8791eaf9a7b114ccbf56eb488aefe7b1f, e9c19d19dd7e08db89cead5b0337c18590dc6645, and efe6dced3512066ebee2cf7c4c38d1c99625814e (Linux Kernel Git). Administrators should update to a patched kernel version that includes these commits. Distributions such as SUSE Linux have begun shipping updates addressing this CVE (LinuxCompatible). As a temporary workaround, restricting unprivileged user access to Panthor GPU devices can reduce exposure until a patched kernel is deployed.