CVE-2025-40111 drm/vmwgfx: Fix Use-after-free in validation
A use-after-free flaw in the vmwgfx driver allows attackers to potentially execute code or escalate privileges via premature resource destruction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40111?
CVE-2025-40111 is a high-severity use after free vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix Use-after-free in validation
Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
Which versions are affected by CVE-2025-40111?
How do I fix CVE-2025-40111?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-40111 being exploited?
There is no known exploitation of CVE-2025-40111 in the wild and no public exploit code.
Sources
Also known as AZL-69956, BELL-CVE-2025-40111, DEBIAN-CVE-2025-40111, GHSA-q6fq-7r5f-c3mx, ROOT-OS-DEBIAN-11-CVE-2025-40111, ROOT-OS-DEBIAN-13-CVE-2025-40111 and 2 more.