← Back to CVE Explorer

CVE-2025-40039

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.

Severity
MEDIUM
CVSS score
4.7 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-28 12:15:37.847000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-40039",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-28T12:15:37.847",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix race condition in RPC handle list access\n\nThe 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd\nsession. Access to this list is intended to be protected by\n'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was\nflawed, leading to potential race conditions.\n\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\nbefore calling xa_store() and xa_erase(). Since these operations modify\nthe XArray structure, a write lock is required to ensure exclusive access\nand prevent data corruption from concurrent modifications.\n\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\nwithout holding any lock at all. This could lead to reading inconsistent\ndata or a potential use-after-free if an entry is concurrently removed and\nthe pointer is dereferenced.\n\nFix these issues by:\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\n   to ensure exclusive access during XArray modification, and ensuring\n   the lock is correctly released on error paths.\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\n   to safely protect the lookup."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: Solución de condición de carrera en el acceso a la lista de manejadores RPC\n\nEl XArray 'sess->rpc_handle_list' gestiona los manejadores RPC dentro de una sesión ksmbd. El acceso a esta lista está destinado a ser protegido por 'sess->rpc_lock' (un rw_semaphore). Sin embargo, la implementación del bloqueo era defectuosa, lo que llevaba a potenciales condiciones de carrera.\n\nEn ksmbd_session_rpc_open(), el código adquirió incorrectamente solo un bloqueo de lectura antes de llamar a xa_store() y xa_erase(). Dado que estas operaciones modifican la estructura del XArray, se requiere un bloqueo de escritura para asegurar el acceso exclusivo y prevenir la corrupción de datos por modificaciones concurrentes.\n\nAdemás, ksmbd_session_rpc_method() accedió a la lista usando xa_load() sin mantener ningún bloqueo en absoluto. Esto podría llevar a la lectura de datos inconsistentes o a un potencial uso después de liberación si una entrada es eliminada concurrentemente y el puntero es desreferenciado.\n\nSe solucionan estos problemas de la siguiente manera:\n1. Usando down_write() y up_write() en ksmbd_session_rpc_open() para asegurar el acceso exclusivo durante la modificación del XArray, y asegurando que el bloqueo se libere correctamente en las rutas de error.\n2. Añadiendo down_read() y up_read() en ksmbd_session_rpc_method() para proteger de forma segura la búsqueda."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "a4348710a7267705b75692dc1a000920481d1d92",
              "lessThan": "69674b029002b1d90b655f014bdf64f404efa54d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "lessThan": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "lessThan": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "lessThan": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "lessThan": "305853cce379407090a73b38c5de5ba748893aee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1f485b54d04a920723984062c912174330a05178",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "052b41ef2abe274f068e892aee81406f11bd1f3a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.15.145",
              "lessThan": "5.16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.123",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.53",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.3",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.15.145",
              "versionEndExcluding": "5.16",
              "matchCriteriaId": "B98C9201-BF17-4E2C-84FF-75EE2AA94DC5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.1.71",
              "versionEndExcluding": "6.2",
              "matchCriteriaId": "163E72B5-0F5D-49E2-AAEA-F11E02D730AD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.3",
              "versionEndExcluding": "6.6.123",
              "matchCriteriaId": "F522E23F-2E27-4FDC-A9A5-FE6B600E1D7D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.53",
              "matchCriteriaId": "A9028AC3-C3E8-4D5D-9235-DE8859551F7E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.17.3",
              "matchCriteriaId": "F55A160F-1578-4C10-ABCB-F90B7E146ED8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}