PT-2025-49377 · Linux+3 · Linux Kernel+3

CVE-2025-40276 · Published 2025-11-07 · Updated 2026-03-13

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the drm/panthor subsystem related to shared memory (shmem) handling. Specifically, the shmem layer zeroes out new pages using cached mappings. Without a CPU flush operation, dirty cachelines may remain, potentially leading to data leaks or asynchronous buffer corruption when these cachelines are evicted. This issue affects the process of mapping buffers in a CPU-uncached manner.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2026-10221

CVE-2025-40276

OPENSUSE-SU-2026:20145-1

SUSE-SU-2026:0278-1

SUSE-SU-2026:0281-1

SUSE-SU-2026:0315-1

SUSE-SU-2026:20207-1

SUSE-SU-2026:20220-1

SUSE-SU-2026:20228-1

SUSE-SU-2026:20564-1

USN-8029-1

USN-8029-2

USN-8029-3

USN-8030-1

USN-8048-1

Affected Products

Debian

Linuxmint

Linux Kernel

Ubuntu

References · 1357

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40276.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-40276 · Security Note
• https://ubuntu.com/security/CVE-2025-40183 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68167 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40134 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68204 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40224 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68210 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40210 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40267 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40078 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20207-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40171 · Vendor Advisory