CVE-2025-40111

A flaw was found in the Linux kernel’s VMware graphics driver (drm/vmwgfx). During the validation process, nodes stored in a duplicates-hashtable come from an arena allocator, which is cleared at the end of vmw_execbuf_process. One node was not properly removed in vmw_validation_drop_ht because its associated resource was destroyed too early, leading to a use-after-free.

This vulnerability is rated as Moderate impact because exploitation requires local authenticated access to DRM device interfaces and relies on specific race conditions during buffer validation. Exposure is restricted to virtualized environments running as VMware guest systems where the VMware graphics device driver is active. On bare-metal installations or virtual machines using other hypervisors, the driver is not initialized, preventing exposure to this defect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.