CVE-2025-40225

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix kernel panic on partial unmap of a GPU VA region

This commit address a kernel panic issue that can happen if Userspace

tries to partially unmap a GPU virtual region (aka drm_gpuva).

The VM_BIND interface allows partial unmapping of a BO.

Panthor driver pre-allocates memory for the new drm_gpuva structures

that would be needed for the map/unmap operation, done using drm_gpuvm

layer. It expected that only one new drm_gpuva would be needed on umap

but a partial unmap can require 2 new drm_gpuva and that's why it

ended up doing a NULL pointer dereference causing a kernel panic.

Following dump was seen when partial unmap was exercised.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078

Mem abort info:

ESR = 0x0000000096000046

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x06: level 2 translation fault

Data abort i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References