CVE-2025-40096
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
View original CVE JSON
{
"id": "CVE-2025-40096",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-30T10:15:34.080",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n for (i = 0; i < fence_count; i++) {\n ret = drm_sched_job_add_dependency(job, fences[i]);\n if (ret)\n break;\n }\n\n for (; i < fence_count; i++)\n dma_fence_put(fences[i]);\n\nWhich means for the failing 'i' the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/sched: Corrige una posible doble liberación en drm_sched_job_add_resv_dependencies\n\nAl añadir dependencias con drm_sched_job_add_dependency(), esa función consume la referencia de la valla tanto en caso de éxito como de fallo, por lo que en este último caso el dma_fence_put() en la ruta de error (xarray no pudo expandirse) es una doble liberación.\n\nCuriosamente, este error parece haber estado presente desde el commit ebd5f74255b9 ('drm/sched: Add dependency tracking'), ya que el código en aquel entonces se veía así:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n for (i = 0; i < fence_count; i++) {\n ret = drm_sched_job_add_dependency(job, fences[i]);\n if (ret)\n break;\n }\n\n for (; i < fence_count; i++)\n dma_fence_put(fences[i]);\n\nLo que significa que para la 'i' fallida el dma_fence_put ya era una doble liberación. Posiblemente no había usuarios en ese momento, o los casos de prueba eran insuficientes para detectarlo.\n\nEl error fue entonces solo notado y corregido después de que el commit 9c2ba265352a ('drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2') aterrizara, con su corrección del commit 4eaf02d6076c ('drm/scheduler: fix drm_sched_job_add_implicit_dependencies').\n\nEn ese momento era una variante ligeramente diferente de una doble liberación, que el commit 963d0b356935 ('drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder') notó e intentó corregir.\n\nPero solo movió la doble liberación de ocurrir dentro de drm_sched_job_add_dependency(), al liberar la referencia aún no obtenida, al llamador, al liberar la referencia ya liberada por el primero en el caso de fallo.\n\nComo tal, no es fácil identificar el objetivo correcto para la etiqueta de correcciones, así que mantengámoslo simple y simplemente continuemos la cadena.\n\nMientras corregimos, también mejoramos el comentario y explicamos la razón para tomar la referencia y no soltarla."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/gpu/drm/scheduler/sched_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "963d0b3569354230f6e2c36a286ef270a8901878",
"lessThan": "4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
"versionType": "git",
"status": "affected"
},
{
"version": "963d0b3569354230f6e2c36a286ef270a8901878",
"lessThan": "57239762aa90ad768dac055021f27705dae73344",
"versionType": "git",
"status": "affected"
},
{
"version": "963d0b3569354230f6e2c36a286ef270a8901878",
"lessThan": "e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
"versionType": "git",
"status": "affected"
},
{
"version": "963d0b3569354230f6e2c36a286ef270a8901878",
"lessThan": "fdfb47e85af1e11ec822c82739dde2dd8dff5115",
"versionType": "git",
"status": "affected"
},
{
"version": "963d0b3569354230f6e2c36a286ef270a8901878",
"lessThan": "5801e65206b065b0b2af032f7f1eef222aa2fd83",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/gpu/drm/scheduler/sched_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.16",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.16",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.158",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.114",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.55",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.5",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-16T19:41:41.321644Z",
"id": "CVE-2025-40096",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}