CVE-2025-40096

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

When adding dependencies with drm_sched_job_add_dependency(), that

function consumes the fence reference both on success and failure, so in

the latter case the dma_fence_put() on the error path (xarray failed to

expand) is a double free.

Interestingly this bug appears to have been present ever since

commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code

back then looked like this:

drm_sched_job_add_implicit_dependencies():

...

for (i = 0; i < fence_count; i++) {

ret = drm_sched_job_add_dependency(job, fences[i]);

if (ret)

break;

}

for (; i < fence_count; i++)

dma_fence_put(fences[i]);

Which means for the failing 'i' the dma_fence_put was already a double

free. Possibly there were no users at that time, or the test cases were

insuff

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References