CVE-2025-40247— drm/msm: Fix pgtable prealloc error path
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于drm/msm页表预分配错误路径处理不当，可能导致空指针解引用。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting InterpreterAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300< b865da18b6cb878f33b5920693d03f23b9c4d1a3 |
affected |
0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300< 830d68f2cb8ab6fb798bb9555016709a9e012af0 |
affected | ||
3.12 |
affected | ||
< 3.12 |
unaffected | ||
6.17.10≤ 6.17.* |
unaffected | ||
6.18≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-40247
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
drm/msm: Fix pgtable prealloc error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix pgtable prealloc error path
The following splat was reported:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000
[0000000000000010] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S 6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT)
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : build_detached_freelist+0x28/0x224
lr : kmem_cache_free_bulk.part.0+0x38/0x244
sp : ffff000a508c7a20
x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350
x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000
x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000
x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8
x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640
x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30
x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940
x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000
x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8
x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00
Call trace:
build_detached_freelist+0x28/0x224 (P)
kmem_cache_free_bulk.part.0+0x38/0x244
kmem_cache_free_bulk+0x10/0x1c
msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0
msm_vma_job_free+0x30/0x240
msm_ioctl_vm_bind+0x1d0/0x9a0
drm_ioctl_kernel+0x84/0x104
drm_ioctl+0x358/0x4d4
__arm64_sys_ioctl+0x8c/0xe0
invoke_syscall+0x44/0x100
el0_svc_common.constprop.0+0x3c/0xe0
do_el0_svc+0x18/0x20
el0_svc+0x30/0x100
el0t_64_sync_handler+0x104/0x130
el0t_64_sync+0x170/0x174
Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6)
---[ end trace 0000000000000000 ]---
Since msm_vma_job_free() is called directly from the ioctl, this looks
like an error path cleanup issue. Which I think results from
prealloc_cleanup() called without a preceding successful
prealloc_allocate() call. So handle that case better.
Patchwork: https://patchwork.freedesktop.org/patch/678677/
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于drm/msm页表预分配错误路径处理不当，可能导致空指针解引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40247
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40247
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-12-04 · 53 CVEs total
| CVE-2025-40261 | 9.8 CRITICAL | nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() |
| CVE-2025-40252 | 9.8 CRITICAL | net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() |
| CVE-2025-40258 | 9.8 CRITICAL | mptcp: fix race condition in mptcp_schedule_work() |
| CVE-2025-40257 | 9.8 CRITICAL | mptcp: fix a race in mptcp_pm_del_add_timer() |
| CVE-2025-40253 | 8.8 HIGH | s390/ctcm: Fix double-kfree |
| CVE-2025-40266 | 8.2 HIGH | KVM: arm64: Check the untrusted offset in FF-A memory share |
| CVE-2025-40244 | 7.8 HIGH | hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() |
| CVE-2025-40250 | 7.8 HIGH | net/mlx5: Clean up only new IRQ glue on request_irq() failure |
| CVE-2025-40262 | 7.8 HIGH | Input: imx_sc_key - fix memory corruption on unload |
| CVE-2025-40251 | 7.8 HIGH | devlink: rate: Unset parent pointer in devl_rate_nodes_destroy |
| CVE-2025-40248 | 7.8 HIGH | vsock: Ignore signal/timeout on connect() if already established |
| CVE-2025-40249 | 7.8 HIGH | gpio: cdev: make sure the cdev fd is still active before emitting events |
| CVE-2025-40245 | 7.8 HIGH | nios2: ensure that memblock.current_limit is set when setting pfn limits |
| CVE-2025-40214 | 7.8 HIGH | af_unix: Initialise scc_index in unix_add_edge(). |
| CVE-2025-40243 | 7.8 HIGH | hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() |
| CVE-2025-40241 | 7.8 HIGH | erofs: fix crafted invalid cases for encoded extents |
| CVE-2025-40233 | 7.8 HIGH | ocfs2: clear extent cache after moving/defragmenting extents |
| CVE-2025-40216 | 7.8 HIGH | io_uring/rsrc: don't rely on user vaddr alignment |
| CVE-2025-40215 | 7.8 HIGH | xfrm: delete x->tunnel as we delete x |
| CVE-2025-40240 | 7.5 HIGH | sctp: avoid NULL dereference when chunk data buffer is missing |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-40247
No comments yet