Skip to content

In the Linux kernel, the following vulnerability has been...

Unreviewed Published Dec 7, 2025 to the GitHub Advisory Database • Updated Dec 7, 2025

Package

No package listedSuggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices

Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
triggered a NULL pointer dereference in ttm_resource_manager_usage(). The root
cause is not that the struct ttm_resource_manager *man pointer itself is NULL,
but that man->bdev (the backing device pointer within the manager) remains
uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
set up VRAM manager structures. When ttm_resource_manager_usage() attempts to
acquire man->bdev->lru_lock, it dereferences the NULL man->bdev, leading to
a kernel OOPS.

  1. amdgpu_cs.c: Extend the existing bandwidth control check in
    amdgpu_cs_get_threshold_for_moves() to include a check for
    ttm_resource_manager_used(). If the manager is not used (uninitialized
    bdev), return 0 for migration thresholds immediately—skipping VRAM-specific
    logic that would trigger the NULL dereference.

  2. amdgpu_kms.c: Update the AMDGPU_INFO_VRAM_USAGE ioctl and memory info
    reporting to use a conditional: if the manager is used, return the real VRAM
    usage; otherwise, return 0. This avoids accessing man->bdev when it is
    NULL.

  3. amdgpu_virt.c: Modify the vf2pf (virtual function to physical function)
    data write path. Use ttm_resource_manager_used() to check validity: if the
    manager is usable, calculate fb_usage from VRAM usage; otherwise, set
    fb_usage to 0 (APUs have no discrete framebuffer to report).

This approach is more robust than APU-specific checks because it:

  • Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
  • Aligns with TTM's design by using its native helper function,
  • Preserves correct behavior for discrete GPUs (which have fully initialized
    man->bdev and pass the ttm_resource_manager_used() check).

v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)

References

Published by the National Vulnerability Database Dec 6, 2025
Published to the GitHub Advisory Database Dec 7, 2025
Last updated Dec 7, 2025

Severity

Unknown

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(4th percentile)

Weaknesses

No CWEs

CVE ID

CVE-2025-40288

GHSA ID

GHSA-5ppv-prh8-hj77

Source code

No known source code

Dependabot alerts are not supported on this advisory because it does not have a package from a supported ecosystem with an affected and fixed version.

Learn more about GitHub language support

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.