Executive brief
A vulnerability was identified in the Linux kernel's GPU Shared Virtual Memory (SVM) component, which manages how graphics processors and the main system processor share memory. Under certain conditions involving large memory pages, the system could incorrectly map memory outside of the intended range. This could allow a local attacker to access or modify sensitive system memory, potentially leading to a full system compromise or data theft.
Technical details
A vulnerability exists in the `drm/gpusvm` component of the Linux kernel due to improper usage of `hmm_pfn_to_map_order()`. When a Heterogeneous Memory Management (HMM) range partially covers a huge page (e.g., 2MB), the kernel may fail to account for range boundaries, leading to the mapping of memory outside the intended range or memory not mapped by the process's memory manager (mm). This is essentially a bounds checking failure during PFN (Page Frame Number) array iteration. An attacker with local access could exploit this to achieve unauthorized read/write access to kernel or other process memory. The fix introduces `drm_gpusvm_hmm_pfn_to_order()` to correctly calculate the mapping order while respecting range boundaries.
Affected products
- Linux Linux 6.15 to 6.17.7
Timeline
- 2025-08-28: disclosed: Initial patch authored
- 2025-12-09: advisory: CVE-2025-40336 published
- 2025-11-13: patched: Fix committed to stable tree