CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached

Published Dec 6, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Flush shmem writes before mapping buffers CPU-uncached

The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted.

Affected Software

2 affected componentsFixes available

Linux Linux kernel

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Dec 6, 2025

CVE Published

via MITRE·09:50 PM

Data Sourced

via MITRE·09:50 PM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

DSA-6126

Frequently Asked Questions

What is the severity of CVE-2025-40276?

CVE-2025-40276 is considered a medium severity vulnerability due to potential data corruption risks.

How do I fix CVE-2025-40276?

To fix CVE-2025-40276, you should upgrade to a patched version of the Linux kernel that addresses this vulnerability.

What are the potential impacts of CVE-2025-40276?

The potential impacts of CVE-2025-40276 include data corruption and instability in systems using affected versions of the Linux kernel.

Which systems are affected by CVE-2025-40276?

CVE-2025-40276 affects all versions of the Linux kernel that utilize the shmem layer for memory management.

Is there a public exploit for CVE-2025-40276?

As of now, there are no known public exploits for CVE-2025-40276, but it is advisable to apply the patch promptly.