Vulnerability-Lookup

FKIE_CVE-2025-40276

Vulnerability from fkie_nvd - Published: 2025-12-06 22:15 - Updated: 2026-07-30 06:24

Severity

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/576c930e5e7dcb937648490611a83f1bf0171048
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7a12f9c96d06b145562f76ffb20369b4692f0911
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8355eea2a2e9c323021dfdcb95d7767d382123c4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8355eea2a2e9c323021dfdcb95d7767d382123c4",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "7a12f9c96d06b145562f76ffb20369b4692f0911",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "576c930e5e7dcb937648490611a83f1bf0171048",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Flush shmem writes before mapping buffers CPU-uncached\n\nThe shmem layer zeroes out the new pages using cached mappings, and if\nwe don\u0027t CPU-flush we might leave dirty cachelines behind, leading to\npotential data leaks and/or asynchronous buffer corruption when dirty\ncachelines are evicted."
    }
  ],
  "id": "CVE-2025-40276",
  "lastModified": "2026-07-30T06:24:25.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.5,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-06T22:15:55.433",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/576c930e5e7dcb937648490611a83f1bf0171048"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7a12f9c96d06b145562f76ffb20369b4692f0911"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8355eea2a2e9c323021dfdcb95d7767d382123c4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2025-40276 (GCVE-0-2025-40276)

Vulnerability from cvelistv5 – Published: 2025-12-06 21:50 – Updated: 2026-08-05 12:09

Title

drm/panthor: Flush shmem writes before mapping buffers CPU-uncached

Summary

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/8355eea2a2e9c3230…
https://git.kernel.org/stable/c/7a12f9c96d06b1455…
https://git.kernel.org/stable/c/576c930e5e7dcb937…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8a1cc07578bf42d85f008316873d710ff684dd29 , < 8355eea2a2e9c323021dfdcb95d7767d382123c4 (git) Affected: 8a1cc07578bf42d85f008316873d710ff684dd29 , < 7a12f9c96d06b145562f76ffb20369b4692f0911 (git) Affected: 8a1cc07578bf42d85f008316873d710ff684dd29 , < 576c930e5e7dcb937648490611a83f1bf0171048 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.17.9 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8355eea2a2e9c323021dfdcb95d7767d382123c4",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "7a12f9c96d06b145562f76ffb20369b4692f0911",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            },
            {
              "lessThan": "576c930e5e7dcb937648490611a83f1bf0171048",
              "status": "affected",
              "version": "8a1cc07578bf42d85f008316873d710ff684dd29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Flush shmem writes before mapping buffers CPU-uncached\n\nThe shmem layer zeroes out the new pages using cached mappings, and if\nwe don\u0027t CPU-flush we might leave dirty cachelines behind, leading to\npotential data leaks and/or asynchronous buffer corruption when dirty\ncachelines are evicted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the DRM render node (`/dev/dri/renderD*`) via the PANTHOR_BO_CREATE / BO_MMAP_OFFSET ioctls and a subsequent mmap(). There is no remote or adjacent-network path to panthor GEM allocation.\nAC:L - The mechanism is deterministic, not a race: on non-coherent arm64 SoCs (all real panthor platforms) the zeroing is never flushed, so a WC mapping reliably reads stale DRAM, and the write-back clobber can be forced on demand by triggering `dma_map_sgtable()` via VM_BIND. No memory-layout grooming or timing window outside the attacker\u0027s control is needed.\nPR:L - All required ioctls are marked DRM_RENDER_ALLOW, so no authentication, DRM master status, or capability is checked \u2014 only an open fd on the render node. That is available to any unprivileged local user on a graphics-enabled system and to every app on Android/embedded Mali devices.\nUI:N - The attacker performs every step itself \u2014 open the render node, create the BO, obtain the mmap offset, mmap and read. No victim action or cooperation is required.\nS:U - The disclosure and corruption occur within the kernel/GPU-driver security authority acting on behalf of the calling process; no VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - Reads through the uncached mapping return residual physical DRAM contents from pages recycled by the buddy allocator, which may hold freed kernel data, page-cache contents, other processes\u0027 memory, or key material. The leak is unbounded in volume and arbitrarily repeatable by allocating large BOs in a loop, amounting to a general physical-memory disclosure primitive.\nI:L - Stale dirty cachelines are written back over data placed in the buffer through the uncached mapping, silently corrupting GPU command streams, descriptors, and compute results. The corruption is real and attacker-triggerable but is confined to the buffer\u0027s own pages and its content is not attacker-chosen, so it is not an arbitrary cross-domain write.\nA:H - A corrupted command stream raises CS_FATAL/CS_UNRECOVERABLE or a progress timeout, both of which call `panthor_device_schedule_reset()` and force a device-wide GPU reset that destroys every context on the system, not just the attacker\u0027s. On the phone, automotive, and embedded devices panthor targets, the GPU drives the display, so a locally repeatable reset storm denies graphics service to all users."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:08.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8355eea2a2e9c323021dfdcb95d7767d382123c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a12f9c96d06b145562f76ffb20369b4692f0911"
        },
        {
          "url": "https://git.kernel.org/stable/c/576c930e5e7dcb937648490611a83f1bf0171048"
        }
      ],
      "title": "drm/panthor: Flush shmem writes before mapping buffers CPU-uncached",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40276",
    "datePublished": "2025-12-06T21:50:59.035Z",
    "dateReserved": "2025-04-16T07:20:57.184Z",
    "dateUpdated": "2026-08-05T12:09:08.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.