CVE-2025-40311

What it actually does

Kernel BUG_ON triggered in vm_insert_page() when mapping vmalloc-backed coherent memory from dma_alloc_coherent(GFP_USER) under enabled IOMMU because VM_MIXEDMAP is not set on the VMA, violating VM_PFNMAP restrictions in the habanalabs driver.

Why it matters to the business

Systems using Habanalabs accelerators may experience unexpected kernel crashes and reboots during device initialization or memory mapping operations, leading to downtime and reduced reliability for AI/ML workloads on affected Linux kernels.

How an attack unfolds

An attacker or workload triggers dma_alloc_coherent with GFP_USER when IOMMU is active, receiving a vmalloc-range address; subsequent mapping without VM_MIXEDMAP causes the kernel to hit BUG_ON and panic. No remote code execution or privilege escalation is possible; the issue is a stability flaw exposed by normal driver usage.

How to fix it

Update to a fixed kernel containing commit 7ec8ac9f73d4a9438c2186768d6de27ace37531e or later; rebuild and reboot. For Ubuntu LTS releases, install the corresponding wireshark packages listed in the fixed_versions if those are the delivery vehicle, or apply the equivalent stable kernel update.

How to confirm the fix worked

Confirm the habanalabs driver no longer panics under IOMMU with GFP_USER allocations by exercising memory mapping paths; verify presence of the VM_MIXEDMAP logic in the VMA setup code and check kernel version against the fixed commit.

Typical attack path

1. Enable IOMMU on the system
2. Load habanalabs driver and allocate coherent memory via dma_alloc_coherent with GFP_USER
3. Map the resulting vmalloc-backed buffer into a VMA without setting VM_MIXEDMAP
4. Trigger vm_insert_page which hits the VM_PFNMAP assertion and panics the kernel

How to detect it

Review kernel logs for BUG_ON messages referencing vm_insert_page or VM_PFNMAP during habanalabs initialization; look for IOMMU-related coherent allocation failures followed by immediate panics. No post-exploitation artifacts exist because the flaw only produces crashes.

What your security team should do

• Prioritize kernel updates on any hosts running habanalabs hardware within the next maintenance window
• Monitor EPSS and KEV status for any change indicating increased exploitability
• Test IOMMU-enabled configurations with Habanalabs devices before production rollout