Get real-time updates on Telegram
CVE-2025-40166: Linux 6.8
CVE-2025-40166. CVSS 3.1 base score 7.8 (HIGH, Source advisory). EPSS 0.00151 (percentile 0.03858), scored 19-Oct-2026.
Affected technology
Linux · dd08ebf6c3525a7ea2186e636df064ea47281987 to before 2c6e5904c5bdbac8e0eadee40f70c42bb83f6dc6, dd08ebf6c3525a7ea2186e636df064ea47281987 to before fa708415566bbe5361c935645107319f8edc8dc1, dd08ebf6c3525a7ea2186e636df064ea47281987 to before 9f64b3cd051b825de0a2a9f145c8e003200cedd5
Linux
Linux · 6.8
Linux
Component: Not specified by the source
File: drivers/gpu/drm/xe/xe_guc_submit.c
Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required
What an attacker can do
The source says however, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.
- CCR priority
- 31.2 /100 (P4)
- CVSS 3.1
- 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Source advisory
- EPSS
- 0.00151 · percentile 0.03858 · 2026-10-19
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-20 01:44:01.123206+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-40166.html