CVE-2025-40335: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40335 is a vulnerability in the Linux kernel's drm/amdgpu driver caused by insufficient validation of user-queue (userq) input arguments passed via IOCTL calls. The fix ensures invalid userq requests are rejected at the IOCTL boundary before further processing. It was published on December 9, 2025, and affects Linux kernel versions from the initial commit up to (but not including) the patched commits 219be4711a1b (for the 6.18 branch) and bdaa7ad3a5bb (for the 6.17.8 branch). The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication) (ENISA EUVD).

The root cause is improper input validation (CWE-20) in the AMD GPU (amdgpu) DRM driver's handling of user-queue IOCTL requests. When a user-space process submits a userq request via IOCTL, the kernel driver did not adequately validate the supplied arguments before processing them, potentially allowing malformed or out-of-bounds inputs to reach deeper driver logic. The fix adds validation checks at the IOCTL entry point to reject invalid userq arguments early. Patches are available in the stable kernel tree at commits 219be4711a1ba788bc2a9fafc117139d133e5fea and bdaa7ad3a5bb606d7dbd5c8627dc7efcb2392eb9 (ENISA EUVD).

Exploitation of this vulnerability could allow a local user with access to the AMD GPU device node to pass malformed arguments through the amdgpu IOCTL interface, potentially causing undefined behavior in the kernel driver. Depending on the nature of the invalid input, this could result in kernel crashes (denial of service), memory corruption, or potentially privilege escalation, though the precise impact has not been formally scored. Systems running AMD GPUs with the amdgpu driver are affected (ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-40335. The EPSS score is extremely low at 0.00018 (approximately 0.018%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with an AMD GPU and the amdgpu driver loaded (ENISA EUVD).

Apply the upstream Linux kernel patches that introduce userq input argument validation in the drm/amdgpu driver. The fixes are included in kernel versions patched at commit 219be4711a1ba788bc2a9fafc117139d133e5fea (targeting Linux 6.18) and bdaa7ad3a5bb606d7dbd5c8627dc7efcb2392eb9 (targeting Linux 6.17.8). Users should update to Linux kernel 6.17.8 or 6.18 (or later), or apply the relevant stable-tree patches provided by their distribution. As a temporary workaround, restricting access to the AMD GPU device node (e.g., via udev rules or user/group permissions) can reduce exposure on multi-user systems (ENISA EUVD).