In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq buffer virtual address and size It needs to validate… (CVE-2025-40334)
A vulnerability in the Linux kernel's AMDGPU driver involves improper validation of the user queue (userq) buffer virtual address and size. The flaw is that the userq object virtual address was not properly checked to ensure it resides within a valid virtual memory mapping. This issue has been resolved in the Linux kernel. The vulnerability has a high severity rating.
AI Analysis
Technical Summary
The Linux kernel AMDGPU driver contained a vulnerability where the userq buffer's virtual address and size were not adequately validated. Specifically, the userq object virtual address was not verified to confirm it was within a valid virtual memory mapping, potentially allowing improper access or manipulation. This vulnerability has been fixed in the Linux kernel source. The CVSS 3.1 vector indicates a local attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality, integrity, and availability with low confidentiality impact but high integrity and availability impact.
Potential Impact
If exploited, this vulnerability could allow a local attacker with low privileges to cause significant integrity and availability issues within the system by manipulating the AMDGPU driver's userq buffer. Confidentiality impact is low, but the potential for high integrity and availability impact suggests possible system instability or unauthorized modification of data related to the AMDGPU driver.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should update their Linux kernel to the latest patched version containing this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the exact patched versions and update guidance.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq buffer virtual address and size It needs to validate… (CVE-2025-40334)
Description
A vulnerability in the Linux kernel's AMDGPU driver involves improper validation of the user queue (userq) buffer virtual address and size. The flaw is that the userq object virtual address was not properly checked to ensure it resides within a valid virtual memory mapping. This issue has been resolved in the Linux kernel. The vulnerability has a high severity rating.
CVSS v3.1
Score 7.3high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel AMDGPU driver contained a vulnerability where the userq buffer's virtual address and size were not adequately validated. Specifically, the userq object virtual address was not verified to confirm it was within a valid virtual memory mapping, potentially allowing improper access or manipulation. This vulnerability has been fixed in the Linux kernel source. The CVSS 3.1 vector indicates a local attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality, integrity, and availability with low confidentiality impact but high integrity and availability impact.
Potential Impact
If exploited, this vulnerability could allow a local attacker with low privileges to cause significant integrity and availability issues within the system by manipulating the AMDGPU driver's userq buffer. Confidentiality impact is low, but the potential for high integrity and availability impact suggests possible system instability or unauthorized modification of data related to the AMDGPU driver.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should update their Linux kernel to the latest patched version containing this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the exact patched versions and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qw3c-jf69-33ww
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40334"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d49c2644c7f8478c1d
Added to database: 07/30/2026, 15:50:44 UTC
Last enriched: 07/30/2026, 18:07:32 UTC
Last updated: 09/10/2026, 19:26:54 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.