CVE-2025-40311: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40311 is a denial-of-service vulnerability in the Linux kernel's accel/habanalabs accelerator driver caused by improper handling of vmalloc-backed coherent memory mappings. When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range; if such an address is mapped without the VM_MIXEDMAP flag, vm_insert_page() triggers a BUG_ON assertion due to the VM_PFNMAP restriction, resulting in a kernel crash. The vulnerability was published on December 8, 2025, and affects the Linux kernel across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is classified as an improper memory mapping condition (related to CWE-476/incorrect assertion handling) in the accel/habanalabs driver. When IOMMU is active, dma_alloc_coherent() with GFP_USER can legitimately return a vmalloc-range address; however, the driver's mmap path calls vm_insert_page() without first setting VM_MIXEDMAP on the VMA, which is required for non-linear/vmalloc-backed pages. This triggers a kernel BUG_ON assertion enforced by the VM_PFNMAP restriction, causing an immediate kernel panic. The fix involves checking whether the returned DMA address falls within the vmalloc range and, if so, setting VM_MIXEDMAP in the VMA flags before proceeding with the mapping. Exploitation requires local access with low privileges and is only triggerable on systems with IOMMU enabled (Red Hat CVE, ENISA EUVD).

Successful exploitation causes a kernel crash (panic via BUG_ON), resulting in a complete denial of service for the affected system — all running processes and services are terminated until the system is rebooted. There is no impact on confidentiality or integrity, as the vulnerability does not allow memory disclosure or data modification. The scope is limited to the local system; lateral movement is not directly facilitated by this vulnerability (Red Hat CVE).

Patches have been backported to multiple Linux kernel stable branches. Users should update to the following fixed versions: 6.6.117, 6.12.58, 6.17.8, or 6.18 (ENISA EUVD). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.112.1-2 and later) via the December 2025 Patch Tuesday update (Microsoft MSRC). As a workaround where patching is not immediately possible, administrators can restrict local user access to the habanalabs device or disable IOMMU if operationally feasible, though neither is a substitute for applying the kernel update.

The vulnerability was included in Microsoft's December 2025 Patch Tuesday advisory, which covered the Azure Linux kernel package (Microsoft MSRC). Security vendors including Tenable and Qualys have added detection coverage for this CVE. No notable independent researcher commentary or significant social media discussion has been observed, consistent with the vulnerability's limited exploitability and narrow scope.