CVE-2025-40310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40310 is a race condition vulnerability in the Linux kernel's AMD GPU driver (amd/amdkfd) that can cause a kernel NULL pointer dereference and system crash. The flaw exists in the amdgpu_amdkfd_device_fini_sw function, where a race between device finalization and KGD interrupt handling can result in a kernel panic. It was published on December 8, 2025, and affects the Linux kernel, including Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.112.1-2. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a race condition (CWE-362) in amdgpu_amdkfd_device_fini_sw: if the function executes between kfd_cleanup_nodes and kfree(kfd) while a KGD interrupt is simultaneously generated, the interrupt handler attempts to dereference a pointer to already-freed or partially-freed memory. This results in a NULL pointer dereference at address 0x0000000000000098, triggering a kernel panic (BUG: kernel NULL pointer dereference) in _raw_spin_lock_irqsave. The attack vector is local, requires low privileges, and no user interaction, but exploitation is limited to systems with AMD GPU hardware running the affected kernel versions (Red Hat CVE). Patches are available via the Linux stable kernel git repository at multiple commit references (e.g., 2f89a2d, 93f8d67, 99d7181, bc9e789).

Successful exploitation causes a kernel panic (system crash), resulting in a complete loss of availability for the affected host. There is no confidentiality or integrity impact, as the vulnerability leads to a denial-of-service condition rather than code execution or data exposure. Systems running AMD GPU workloads (e.g., GPU compute nodes, workstations with AMD GPUs) are at risk of unexpected reboots or crashes, which could disrupt services or workloads dependent on those systems (Red Hat CVE).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-40310. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with AMD GPU hardware and a vulnerable kernel version, significantly limiting the attack surface (Red Hat CVE).

Apply the patched Linux kernel versions that include the fix for amdgpu_amdkfd_device_fini_sw. Patches have been committed to the Linux stable kernel repository (commits 2f89a2d15550, 93f8d67ef8b5, 99d7181bca34, bc9e789053ab). For Microsoft Azure Linux 3 users, update to kernel version azl3_kernel_6.6.112.1-2 or later as indicated by the Microsoft MSRC advisory. Organizations without AMD GPU hardware are not affected and no action is required (Microsoft MSRC, Red Hat CVE).