CVE-2025-40332

drm/amdkfd: Fix mmap write lock not release

N/A
Published: December 9, 2025 at 04:09 AM UTC
Updated: October 14, 2026 at 10:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svm_range_restore_pages calls mmap_read_unlock then returns. This causes deadlock and system hangs later because mmap read or write lock cannot be taken. Downgrade mmap write lock to read lock if draining retry fault fix this bug.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.12.24 ≤ v < 6.12.586.13.12 ≤ v < 6.146.14.3 ≤ v < 6.15177660d7ecb34298dab5f0d1efc7e8b02f9345515a3c09bd25cc0a55ec9c048710d379fa2c84b4e76.12.246.13.126.14.36.15e64be12f8401819662e608efa247638b61d023cdf844732e3ad9c4b78df7436232949b8d2096d1a6
Vendor states this is fixed in 7574f30337e19045f03126b4c51f525b84e5049e (fixed)
Vendor states this is fixed in e2105ba1c262dcaa9573f11844b6e1e1ca762c3f (fixed)
Vendor states this is fixed in f7569ef1cf978aa87aa81b5e9bf40a77497f3685 (fixed)
Vendor states this is fixed in 6.12.58 (unaffected)
Affected range stops below 6.14, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.17.8 (unaffected)
Vendor states this is fixed in 6.18 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card