{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"MEDIUM" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n for (i = 0; i < fence_count; i++) {\n ret = drm_sched_job_add_dependency(job, fences[i]);\n if (ret)\n break;\n }\n\n for (; i < fence_count; i++)\n dma_fence_put(fences[i]);\n\nWhich means for the failing 'i' the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it.", "category":"general", "title":"Synopsis" } ], "publisher":null, "references":[ { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40096" }, { "summary":"CVE-2025-40096 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/cve/2025/csaf-openeuler-cve-2025-40096.json" }, { "summary":"openEuler-SA-2026-1761", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1761" }, { "summary":"CVE-2025-40096", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-40096&packageName=kernel" } ], "title":"openEuler cve CVE-2025-40096", "tracking":{ "initial_release_date":"2026-03-30T15:49:39+08:00", "revision_history":[ { "date":"2026-03-30T15:49:39+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-03-30T15:49:39+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-03-30T15:49:39+08:00", "id":"CVE-2025-40096", "version":"1.0.0", "status":"interim" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"openEuler-24.03-LTS-SP2", "name":"openEuler-24.03-LTS-SP2" }, "name":"openEuler-24.03-LTS-SP2", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm" }, "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm" }, "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP2" }, "product_id":"kernel-6.6.0-144.0.0.140.oe2403sp2.src.rpm", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.src.rpm" }, "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.src.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:perf-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"perf-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64", "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.aarch64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"bpftool-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"bpftool-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-debugsource-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-extra-modules-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-headers-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-source-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-tools-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-tools-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"kernel-tools-devel-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:perf-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"perf-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"python3-perf-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64", "name":"python3-perf-debuginfo-6.6.0-144.0.0.140.oe2403sp2.x86_64 as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP2", "product_reference":"kernel-6.6.0-144.0.0.140.oe2403sp2.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP2:kernel-6.6.0-144.0.0.140.oe2403sp2.src", "name":"kernel-6.6.0-144.0.0.140.oe2403sp2.src as a component of openEuler-24.03-LTS-SP2" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2025-40096", "notes":[ { "text":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n for (i = 0; i < fence_count; i++) {\n ret = drm_sched_job_add_dependency(job, fences[i]);\n if (ret)\n break;\n }\n\n for (; i < fence_count; i++)\n dma_fence_put(fences[i]);\n\nWhich means for the failing 'i' the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":{ "$ref":"$.vulnerabilities[0].product_status.fixed" } }, "remediations":[ { "product_ids":{ "$ref":"$.vulnerabilities[0].product_status.fixed" }, "details":"kernel security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1761" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.0, "vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":{ "$ref":"$.vulnerabilities[0].product_status.fixed" } } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2025-40096" } ] }