---
id: CVE-2025-40336
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: fix hmm_pfn_to_map_order() usage

  Handle the case where the hmm range partially covers a huge page (like
  2M), otherwise we can potentially end up doing some…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: fix hmm_pfn_to_map_order() usage

  Handle the case where the hmm range partially covers a huge page (like
  2M), otherwise we can potentially end up doing some…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 99624bdff8670795b678eafa6509aaad3a5c0175 <
    08e9fd78ba1b9e95141181c69cc51795c9888157
  - >-
    Linux >= 99624bdff8670795b678eafa6509aaad3a5c0175 <
    c50729c68aaf93611c855752b00e49ce1fdd1558
  - Linux 6.15
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:19:08.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40336'
references:
  - url: 'https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0017
epssPercentile: 0.06371
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:59:29.236103Z'
ingestedAt: '2026-10-14T23:00:02.032Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: fix hmm_pfn_to_map_order() usage

Handle the case where the hmm range partially covers a huge page (like
2M), otherwise we can potentially end up doing something nasty like
mapping memory which is outside the range, and maybe not even mapped by
the mm. Fix is based on the xe userptr code, which in a future patch
will directly use gpusvm, so needs alignment here.

v2:
  - Add kernel-doc (Matt B)
  - s/fls/ilog2/ (Thomas)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.