CVE-2025-40336 addresses a vulnerability in the Linux kernel's drm/gpusvm subsystem where the function hmm_pfn_to_map_order() did not correctly handle HMM ranges partially covering huge pages (e.g., 2M pages). This flaw could cause the kernel to map memory regions outside the specified range, including memory not mapped by the process's memory manager, leading to potential unauthorized memory access or corruption. The patch corrects this by adopting logic from the xe userptr code, ensuring proper alignment and range checking. The vulnerability affects kernel memory management related to GPU shared virtual memory and was fixed in a kernel update.

The vulnerability allows potential mapping of memory outside the intended HMM range, which could lead to unauthorized access to memory regions, compromising confidentiality and integrity. It also poses a risk to system stability and availability due to possible memory corruption or improper memory mappings. The CVSS vector indicates local attack complexity with low privileges required, no user interaction, and a scope change, resulting in high impact on confidentiality, integrity, and availability.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Since this is a kernel-level vulnerability, upgrading to the fixed kernel version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; therefore, verify with the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.