Security tracker / CVE-2025-40086

CVE-2025-40086

drm/xe: Don't allow evicting of BOs in same VM in array of VM binds

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 774b5fa509a9 ("drm/xe: Avoid evicting object of the same vm in
 carnil> none fault mode")
 carnil> 77f2ef3f16f5 ("drm/xe: Lock all gpuva ops during VM bind IOCTL")
 carnil> dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs"). Vulnerable
 carnil> versions: 6.8.

Bugs

Status

Branch	Status
upstream	released (6.18-rc2) [7ac74613e5f2ef3450f44fd2127198662c2563a9]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	released (6.17.5) [5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384]
6.12-upstream-stable	needed
6.6-upstream-stable	N/A "Vulnerable code not present"
6.1-upstream-stable	N/A "Vulnerable code not present"
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.17.6-1)
6.12-trixie-security	needed
6.1-bookworm-security	N/A "Vulnerable code not present"
5.10-bullseye-security	N/A "Vulnerable code not present"