cve 2025 40096

CVE-2025-40096 is a Linux-kernel vulnerability in the DRM scheduler (drm/sched) that can cause a double free when dependency handling fails. Microsoft's Security Response Center (MSRC) has issued an attestation stating that Azure Linux includes the affected open-source component and is potentially vulnerable. However, this attestation does not guarantee that other Microsoft products—such as WSL, linux-azure kernels, or Marketplace images—are unaffected. Artifact-level verification is needed to determine exposure across these products. The tag covers discussions about the CVE's impact on Azure Linux and the broader Microsoft ecosystem.