{"id":"CVE-2025-40340","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel…","severity":"none","published":"2025-12-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T22:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-40340","references":[{"url":"https://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00219,"epssPercentile":0.1149,"ingestedAt":"2026-10-14T23:00:02.033Z","slug":"CVE-2025-40340","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.\n\nI saw an oops in xe_gem_fault when running the xe-fast-feedback\ntestlist against the realtime kernel without debug options enabled.\n\nThe panic happens after core_hotunplug unbind-rebind finishes.\nPresumably what happens is that a process mmaps, unlocks because\nof the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,\ncausing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since\nthere was nothing left to populate, and then oopses in\n\"mem_type_is_vram(tbo->resource->mem_type)\" because tbo->resource\nis NULL.\n\nIt's convoluted, but fits the data and explains the oops after\nthe test exits.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}