CVE-2025-40249

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Deferred

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-12-04 16:16:18.380000

Last modified

2026-10-19 21:10:00.160000

View original CVE JSON

{
  "id": "CVE-2025-40249",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-04T16:16:18.380",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It's possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: cdev: asegurar que el fd del cdev sigue activo antes de emitir eventos\n\nCon la llamada final a fput() en un descriptor de archivo, la acción de liberación puede ser diferida y programada en una cola de trabajo. El contador de referencias de ese descriptor sigue siendo cero y no debe ser usado. Es posible que un cambio de GPIO, sobre el cual queremos notificar al espacio de usuario, ocurra DESPUÉS de que el contador de referencias en el descriptor de archivo asociado con el dispositivo de caracteres bajó a cero, pero ANTES de que la devolución de llamada .release() fuera invocada desde la cola de trabajo y, por lo tanto, ANTES de que nos desregistráramos del notificador.\n\nUsar la rutina get_file() regular en esta situación desencadena la siguiente advertencia:\n\n  struct file::f_count incrementado desde cero; ¡condición de uso después de liberación presente!\n\nAsí que usar la variante get_file_active() que devolverá NULL en descriptores de archivo que han sido o están siendo liberados."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "lessThan": "dccc6daa8afa0f64c432e4c867f275747e3415e1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "lessThan": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.13",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.13",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.10",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}