CVE-2025-40096

A flaw was found in the kernel subsystem handling of the DRM scheduler. Under certain error conditions, the function drm_sched_job_add_dependency() consumes a fence reference and then later erroneously attempts to free it again (double free). This may lead to memory corruption and, in some configurations, escalation of privileges.

Red Hat has assessed this vulnerability as having a Moderate impact because exploitation requires authenticated local access and depends on triggering a specific allocation failure during DRM job dependency management, resulting in a high barrier for reliable execution. The issue affects the Linux kernel's Direct Rendering Manager (DRM) scheduler, where failure to expand internal tracking structures improperly releases synchronization fence references more than once. While this flaw can lead to kernel memory corruption or local privilege escalation on systems where GPU devices are exposed, standard server deployments lacking active DRM workloads or hardware acceleration face substantially reduced attack surfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.