CVE-2025-40260

{
  "id": "CVE-2025-40260",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-04T16:16:19.927",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix scx_enable() crash on helper kthread creation failure\n\nA crash was observed when the sched_ext selftests runner was\nterminated with Ctrl+\\ while test 15 was running:\n\nNIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0\nLR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0\nCall Trace:\nscx_enable.constprop.0+0x32c/0x12b0 (unreliable)\nbpf_struct_ops_link_create+0x18c/0x22c\n__sys_bpf+0x23f8/0x3044\nsys_bpf+0x2c/0x6c\nsystem_call_exception+0x124/0x320\nsystem_call_vectored_common+0x15c/0x2ec\n\nkthread_run_worker() returns an ERR_PTR() on failure rather than NULL,\nbut the current code in scx_alloc_and_add_sched() only checks for a NULL\nhelper. Incase of failure on SIGQUIT, the error is not handled in\nscx_alloc_and_add_sched() and scx_enable() ends up dereferencing an\nerror pointer.\n\nError handling is fixed in scx_alloc_and_add_sched() to propagate\nPTR_ERR() into ret, so that scx_enable() jumps to the existing error\npath, avoiding random dereference on failure."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Corrección del fallo de scx_enable() al fallar la creación del kthread auxiliar\n\nSe observó un fallo cuando el ejecutor de autopruebas de sched_ext fue terminado con Ctrl+\\\\ mientras se ejecutaba la prueba 15:\n\nNIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0\nLR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0\nTraza de Llamada:\nscx_enable.constprop.0+0x32c/0x12b0 (no fiable)\nbpf_struct_ops_link_create+0x18c/0x22c\n__sys_bpf+0x23f8/0x3044\nsys_bpf+0x2c/0x6c\nsystem_call_exception+0x124/0x320\nsystem_call_vectored_common+0x15c/0x2ec\n\nkthread_run_worker() devuelve un ERR_PTR() en caso de fallo en lugar de NULL, pero el código actual en scx_alloc_and_add_sched() solo verifica un auxiliar NULL. En caso de fallo en SIGQUIT, el error no se maneja en scx_alloc_and_add_sched() y scx_enable() termina desreferenciando un puntero de error.\n\nEl manejo de errores se ha corregido en scx_alloc_and_add_sched() para propagar PTR_ERR() a ret, de modo que scx_enable() salta a la ruta de error existente, evitando la desreferencia aleatoria en caso de fallo."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "bff3b5aec1b727b620adc7c47085592802390125",
              "lessThan": "625e173e2a59b6cf6cbfb51c0a6bea47f3861eab",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bff3b5aec1b727b620adc7c47085592802390125",
              "lessThan": "7b6216baae751369195fa3c83d434d23bcda406a",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.10",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/625e173e2a59b6cf6cbfb51c0a6bea47f3861eab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b6216baae751369195fa3c83d434d23bcda406a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}