---
id: CVE-2025-40336
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: fix hmm_pfn_to_map_order() usage

  Handle the case where the hmm range partially covers a huge page (like
  2M), otherwise we can potentially end up doing some…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: fix hmm_pfn_to_map_order() usage

  Handle the case where the hmm range partially covers a huge page (like
  2M), otherwise we can potentially end up doing some…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40336'
references:
  - url: 'https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0017
epssPercentile: 0.05946
ingestedAt: '2026-10-14T23:00:02.032Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: fix hmm_pfn_to_map_order() usage

Handle the case where the hmm range partially covers a huge page (like
2M), otherwise we can potentially end up doing something nasty like
mapping memory which is outside the range, and maybe not even mapped by
the mm. Fix is based on the xe userptr code, which in a future patch
will directly use gpusvm, so needs alignment here.

v2:
  - Add kernel-doc (Matt B)
  - s/fls/ilog2/ (Thomas)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.