CVE-2025-40332: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40332 is a deadlock vulnerability in the Linux kernel's drm/amdkfd subsystem caused by an mmap write lock not being properly released. When an mmap write lock is acquired during a retry fault drain operation, svm_range_restore_pages calls mmap_read_unlock and returns without releasing the write lock, leaving the system in a deadlocked state where no subsequent mmap read or write lock can be acquired. This affects the Linux kernel across a broad range of versions prior to the fixes introduced in 6.12.58, 6.17.8, and 6.18. The vulnerability was published on December 9, 2025, with an EPSS score of 0.017% (very low), and no CVSS base score has been formally assigned (Feedly, ENISA EUVD).

The root cause is improper lock management (CWE-667: Improper Locking) in the AMD GPU kernel driver's Shared Virtual Memory (SVM) fault handling path. Specifically, in svm_range_restore_pages, when the function is invoked while an mmap write lock is held during a retry fault drain, it calls mmap_read_unlock instead of the appropriate write unlock, then returns — leaving the write lock unreleased. The fix downgrades the mmap write lock to a read lock before entering the retry fault drain path, ensuring the lock state remains consistent. Patches are available in the stable kernel tree at commits e2105ba1c262, f7569ef1cf97, and 7574f30337e1 (ENISA EUVD, Kernel Git).

Successful triggering of this bug results in a system-wide deadlock: once the mmap write lock is leaked, no process can subsequently acquire an mmap read or write lock, causing the system to hang indefinitely. The primary impact is a denial of service (availability), as the affected host becomes unresponsive and requires a reboot to recover. This is particularly relevant on systems running AMD GPUs with the amdkfd driver and workloads that exercise SVM retry fault handling, such as GPU compute or machine learning environments (Feedly, ENISA EUVD).

Apply the upstream Linux kernel patches that fix this issue. The corrected versions are Linux 6.12.58, 6.17.8, and 6.18 (and later). The relevant commits are e2105ba1c262dcaa9573f11844b6e1e1ca762c3f, f7569ef1cf978aa87aa81b5e9bf40a77497f3685, and 7574f30337e19045f03126b4c51f525b84e5049e in the stable kernel tree. As a temporary workaround on systems where patching is not immediately possible, disabling or unloading the amdkfd kernel module (if AMD GPU compute functionality is not required) can prevent the vulnerable code path from being reached (ENISA EUVD, Kernel Git).