---
id: CVE-2025-40111
title: 'drm/vmwgfx: Fix Use-after-free in validation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: Fix Use-after-free in validation

  Nodes stored in the validation duplicates hashtable come from an arena
  allocator that is cleared at the end of vmw_execbuf…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    1822e5287b7dfa59d0af966756ebf1dc652b60ee
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    fb7165e5f3b3b10721ff70553583ad12e90e447a
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    4c918f9d1ccccc0e092f43dcb2d8266f54d7340b
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    9a8eaca539708ca532747f606d231f70e684e8ca
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    867bda5d95d36f10da398fd4409e21c7002b2332
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    655a2f29bfc21105c80bf8a7d7aafa6eca8b4496
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    65608e991c2d771c13404e5c7ae122ac3c3357a4
  - >-
    Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 <
    dfe1323ab3c8a4dd5625ebfdba44dc47df84512a
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:57:01.164715Z'
published: '2025-11-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:38.116Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40111'
references:
  - url: 'https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee'
  - url: 'https://git.kernel.org/stable/c/fb7165e5f3b3b10721ff70553583ad12e90e447a'
  - url: 'https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b'
  - url: 'https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca'
  - url: 'https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332'
  - url: 'https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496'
  - url: 'https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4'
  - url: 'https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a'
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.03673
ingestedAt: '2026-10-15T22:48:25.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix Use-after-free in validation

Nodes stored in the validation duplicates hashtable come from an arena
allocator that is cleared at the end of vmw_execbuf_process. All nodes
are expected to be cleared in vmw_validation_drop_ht but this node escaped
because its resource was destroyed prematurely.

## Affected

- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 1822e5287b7dfa59d0af966756ebf1dc652b60ee`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < fb7165e5f3b3b10721ff70553583ad12e90e447a`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 4c918f9d1ccccc0e092f43dcb2d8266f54d7340b`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 9a8eaca539708ca532747f606d231f70e684e8ca`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 867bda5d95d36f10da398fd4409e21c7002b2332`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 655a2f29bfc21105c80bf8a7d7aafa6eca8b4496`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < 65608e991c2d771c13404e5c7ae122ac3c3357a4`
- `Linux >= 64ad2abfe9a628ce79859d072704bd1ef7682044 < dfe1323ab3c8a4dd5625ebfdba44dc47df84512a`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.