CVE-2025-40039

CVE Enrichment

CVSS: 4.7 MEDIUM
EPSS: 0.31%
EPSS Percentile: 24.28%
CISA KEV: Not listed

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published: 28-Oct-2025 19:15
Last Modified: 20-Oct-2026 04:10
EPSS Date: 2026-11-05
CWE: CWE-362

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:H /
                            PR:L /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

CNA Products / Version Status

Linux · Linux Source: CNA · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Default status: affected

6.3 — affected
0 ≤ version < 6.3 — unaffected (semver)
6.6.123 ≤ version ≤ 6.6.* — unaffected (semver)
6.12.53 ≤ version ≤ 6.12.* — unaffected (semver)
6.17.3 ≤ version ≤ 6.17.* — unaffected (semver)
6.18 ≤ version ≤ * — unaffected (original_commit_for_fix)

repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Linux · Linux Source: CNA · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Default status: unaffected

a4348710a7267705b75692dc1a000920481d1d92 ≤ version < 69674b029002b1d90b655f014bdf64f404efa54d — affected (git)
b685757c7b08d5073046fb379be965fd6c06aafc ≤ version < 6b615a8fb3af0baf8126cde3d4fee97d57222ffc — affected (git)
b685757c7b08d5073046fb379be965fd6c06aafc ≤ version < 5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 — affected (git)
b685757c7b08d5073046fb379be965fd6c06aafc ≤ version < 6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 — affected (git)
b685757c7b08d5073046fb379be965fd6c06aafc ≤ version < 305853cce379407090a73b38c5de5ba748893aee — affected (git)
1f485b54d04a920723984062c912174330a05178 — affected (git)
052b41ef2abe274f068e892aee81406f11bd1f3a — affected (git)
5.15.145 ≤ version < 5.16 — affected (semver)

repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected Products / Versions

linux / linux_kernel Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.15.145 · before (exclusive) 5.16
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux / linux_kernel Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.1.71 · before (exclusive) 6.2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux / linux_kernel Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.3 · before (exclusive) 6.6.123
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux / linux_kernel Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.7 · before (exclusive) 6.12.53
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux / linux_kernel Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.13 · before (exclusive) 6.17.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

References

Last enrichment sync: 06-Nov-2026 18:46
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Tracked as CVE-2026-23226 (CVSS score: 8.8), it falls under the same bug class as CVE-2025-40039, which was patched in October 2025. Weekly Security Roundup Details Phorpiex Botnet, ActiveMQ RCE and AI-Related Threats

CVE (4)

Malware (13)

People (3)

Threat Actors (2)

MITRE ATT&CK (6)

Vendors (6)

Products (11)

Industries (7)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.