CVE-2025-40276: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40276 is a vulnerability in the Linux kernel's drm/panthor GPU driver subsystem, where shmem (shared memory) writes are not flushed before mapping buffers as CPU-uncached. The shmem layer zeroes new pages using cached mappings, and without a CPU cache flush, dirty cachelines may be left behind, leading to potential data leaks and/or asynchronous buffer corruption when those cachelines are evicted. The vulnerability was published on December 6, 2025, and affects Linux kernel versions from 6.10 up to (but not including) the patched commits. It is estimated as Medium severity with an EPSS score of 0.00018 (Red Hat CVE, ENISA EUVD).

The root cause is a missing CPU cache flush in the drm/panthor driver (CWE-459: Incomplete Cleanup / improper cache coherency management). When the shmem layer allocates and zeroes new pages using cached CPU mappings, and those pages are subsequently mapped as CPU-uncached for GPU use, any dirty cachelines from the cached write phase may not be written back to physical memory before the uncached mapping is established. This cache coherency gap means the GPU (or other uncached readers) may observe stale or uninitialized data, and when the dirty cachelines are eventually evicted, they can overwrite data written through the uncached mapping, causing asynchronous buffer corruption. The fix involves explicitly flushing CPU caches after shmem writes and before establishing the uncached mapping, as reflected in the upstream kernel patches (ENISA EUVD, Kernel Patch 1, Kernel Patch 2).

Exploitation of this vulnerability can result in two primary consequences: information disclosure (data leaks from stale cachelines exposing memory contents to unauthorized GPU processes or users) and data integrity loss (asynchronous buffer corruption when dirty cachelines are evicted and overwrite GPU-visible memory). The impact is local in nature, affecting systems running the Panthor GPU driver (used with Arm Mali Valhall and later GPU architectures), and could allow a local user or process to read sensitive data from other processes' memory or cause unpredictable behavior in GPU workloads (Red Hat CVE, ENISA EUVD).

The vulnerability is fixed in Linux kernel stable branches via upstream commits 7a12f9c96d06b145562f76ffb20369b4692f0911 (for one stable branch) and 576c930e5e7dcb937648490611a83f1bf0171048 (for another), with the fix also included in kernel 6.17.9 and 6.18. Users should update to a patched kernel version as soon as it is available for their distribution. Debian has addressed this in linux-signed-amd64 version 6.12.69+1, and SUSE has issued updates as well; Red Hat is tracking the issue. As a workaround where patching is not immediately possible, restricting local user access to GPU resources (e.g., limiting /dev/dri device access) can reduce exposure (Kernel Patch 1, Kernel Patch 2, Red Hat CVE).

The vulnerability received routine coverage from vulnerability tracking services and Linux distribution security teams, including Red Hat, Debian, SUSE, and Tenable (Nessus/Qualys detection plugins). No notable researcher commentary or significant social media discussion has been identified beyond standard CVE publication and scanner detection updates (Red Hat CVE, ENISA EUVD).