CVE-2025-40336: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40336 is a vulnerability in the Linux kernel's drm/gpusvm subsystem related to incorrect usage of hmm_pfn_to_map_order(). The flaw occurs when an HMM (Heterogeneous Memory Management) range partially covers a huge page (e.g., 2MB), potentially causing memory outside the intended range — and possibly not mapped by the memory manager — to be mapped. It was published on December 9, 2025, and affects Linux kernel versions prior to 6.17.8 and 6.18. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication) (ENISA EUVD).

The root cause is improper handling of partial huge page coverage within the drm/gpusvm subsystem's HMM range processing logic (CWE classification not formally assigned, but relates to incorrect memory mapping/boundary handling). When hmm_pfn_to_map_order() returns a map order for a huge page that only partially overlaps the requested HMM range, the code previously failed to account for this misalignment, potentially mapping memory beyond the intended range. The fix aligns the gpusvm logic with the existing xe userptr code, using ilog2() instead of fls() and adding proper boundary checks. Patches are available as kernel commits 08e9fd78ba1b (stable branch) and c50729c68aaf (ENISA EUVD, Kernel Patch 1, Kernel Patch 2).

Exploitation of this vulnerability could result in incorrect memory mappings within GPU SVM operations, potentially exposing memory regions outside the intended HMM range to GPU access. This may lead to information disclosure (reading memory not belonging to the process), memory corruption, or undefined behavior in GPU-accelerated workloads. The impact is primarily local to systems using GPU SVM with HMM-backed huge pages, and lateral movement potential is limited given the local nature of the flaw (ENISA EUVD).

The fix is included in Linux kernel versions 6.17.8 and 6.18. Users should update to these patched versions or apply the relevant stable kernel commits (08e9fd78ba1b9e95141181c69cc51795c9888157 for one branch and c50729c68aaf93611c855752b00e49ce1fdd1558 for another). No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (ENISA EUVD, Kernel Patch 1, Kernel Patch 2).