{"id":"CVE-2025-40111","title":"drm/vmwgfx: Fix Use-after-free in validation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 1822e5287b7dfa59d0af966756ebf1dc652b60ee","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < fb7165e5f3b3b10721ff70553583ad12e90e447a","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 4c918f9d1ccccc0e092f43dcb2d8266f54d7340b","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 9a8eaca539708ca532747f606d231f70e684e8ca","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 867bda5d95d36f10da398fd4409e21c7002b2332","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 655a2f29bfc21105c80bf8a7d7aafa6eca8b4496","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 65608e991c2d771c13404e5c7ae122ac3c3357a4","Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < dfe1323ab3c8a4dd5625ebfdba44dc47df84512a","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:57:01.164715Z"},"published":"2025-11-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:38.116Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40111","references":[{"url":"https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee"},{"url":"https://git.kernel.org/stable/c/fb7165e5f3b3b10721ff70553583ad12e90e447a"},{"url":"https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b"},{"url":"https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca"},{"url":"https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332"},{"url":"https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496"},{"url":"https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4"},{"url":"https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a"}],"tags":["cve.org"],"epss":0.00149,"epssPercentile":0.03673,"ingestedAt":"2026-10-15T22:48:25.546Z","slug":"CVE-2025-40111","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely.\n\n## Affected\n\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 1822e5287b7dfa59d0af966756ebf1dc652b60ee`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < fb7165e5f3b3b10721ff70553583ad12e90e447a`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 4c918f9d1ccccc0e092f43dcb2d8266f54d7340b`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 9a8eaca539708ca532747f606d231f70e684e8ca`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 867bda5d95d36f10da398fd4409e21c7002b2332`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 655a2f29bfc21105c80bf8a7d7aafa6eca8b4496`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 65608e991c2d771c13404e5c7ae122ac3c3357a4`\n- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < dfe1323ab3c8a4dd5625ebfdba44dc47df84512a`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}