CVE-2025-40027

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40027", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.152Z", "datePublished": "2025-10-28T09:32:34.162Z", "dateUpdated": "2026-08-05T12:07:09.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:09.837Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix double req put in p9_fd_cancelled\n\nSyzkaller reports a KASAN issue as below:\n\ngeneral protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]\nCPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:__list_del include/linux/list.h:114 [inline]\nRIP: 0010:__list_del_entry include/linux/list.h:137 [inline]\nRIP: 0010:list_del include/linux/list.h:148 [inline]\nRIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734\n\nCall Trace:\n <TASK>\n p9_client_flush+0x351/0x440 net/9p/client.c:614\n p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734\n p9_client_version net/9p/client.c:920 [inline]\n p9_client_create+0xb51/0x1240 net/9p/client.c:1027\n v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408\n v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126\n legacy_get_tree+0x108/0x220 fs/fs_context.c:632\n vfs_get_tree+0x8e/0x300 fs/super.c:1573\n do_new_mount fs/namespace.c:3056 [inline]\n path_mount+0x6a6/0x1e90 fs/namespace.c:3386\n do_mount fs/namespace.c:3399 [inline]\n __do_sys_mount fs/namespace.c:3607 [inline]\n __se_sys_mount fs/namespace.c:3584 [inline]\n __x64_sys_mount+0x283/0x300 fs/namespace.c:3584\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nThis happens because of a race condition between:\n\n- The 9p client sending an invalid flush request and later cleaning it up;\n- The 9p client in p9_read_work() canceled all pending requests.\n\n Thread 1 Thread 2\n ...\n p9_client_create()\n ...\n p9_fd_create()\n ...\n p9_conn_create()\n ...\n // start Thread 2\n INIT_WORK(&m->rq, p9_read_work);\n p9_read_work()\n ...\n p9_client_rpc()\n ...\n ...\n p9_conn_cancel()\n ...\n spin_lock(&m->req_lock);\n ...\n p9_fd_cancelled()\n ...\n ...\n spin_unlock(&m->req_lock);\n // status rewrite\n p9_client_cb(m->client, req, REQ_STATUS_ERROR)\n // first remove\n list_del(&req->req_list);\n ...\n\n spin_lock(&m->req_lock)\n ...\n // second remove\n list_del(&req->req_list);\n spin_unlock(&m->req_lock)\n ...\n\nCommit 74d6a5d56629 (\"9p/trans_fd: Fix concurrency del of req_list in\np9_fd_cancelled/p9_read_work\") fixes a concurrency issue in the 9p filesystem\nclient where the req_list could be deleted simultaneously by both\np9_read_work and p9_fd_cancelled functions, but for the case where req->status\nequals REQ_STATUS_RCVD.\n\nUpdate the check for req->status in p9_fd_cancelled to skip processing not\njust received requests, but anything that is not SENT, as whatever\nchanged the state from SENT also removed the request from its list.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n[updated the check from status == RECV || status == ERROR to status != SENT]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered only from `p9_client_flush()`, which runs solely when a local process's 9p RPC returns `-ERESTARTSYS` from `io_wait_event_killable()` \u2014 i.e. it requires a local task doing filesystem I/O on a 9p mount and receiving a signal. A remote 9p server can trigger `p9_conn_cancel()` but cannot supply the signal half of the race, so no purely network-based trigger exists.\nAC:L - The attacker drives both sides of the race with their own threads: signals to force the `-ERESTARTSYS`/`p9_client_flush()` path, and late replies for already-flushed tags (or, with `trans=fd`, direct writes/hangups on the attacker-owned pipe or socketpair) to force `p9_conn_cancel()` into the window. The window is repeatable at will across many threads and was reached by syzkaller with no special preconditions.\nPR:L - On the common deployments where a 9p mount already exists (QEMU/KVM virtfs shares, WSL2 9p-over-hvsock with `trans=fd`, Crostini, kata containers, 9p network roots), any unprivileged local account with access to the mount can issue RPCs, self-signal to reach `p9_fd_cancelled()`, and provoke `p9_conn_cancel()` \u2014 no capability is checked anywhere on this path.\nUI:N - The attacking process performs every step itself \u2014 open/read on the 9p mount, deliver the fatal signal, and induce the transport error. The pre-existing mount is system configuration, not a victim action taken during the attack.\nS:U - The corruption is confined to the kernel's own slab (`p9_req_cache` and the fcall buffers) within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The extra `p9_req_put()` frees the `struct p9_req_t` and its `tc`/`rc` buffers while `p9_client_rpc()` still uses them, so `p9_check_errors()` parses a reallocated heap object as a 9p reply \u2014 an attacker who sprays the freed chunk obtains a controlled read of kernel heap contents (pointers, keys, KASLR data).\nI:H - The same premature free yields a double free of a slab object plus a `list_del()` on `req->req_list` after the object may be reclaimed, giving an attacker-controlled `next->prev = prev` write primitive over kernel memory, which is the classic path to control-flow hijack and privilege escalation.\nA:H - Even unweaponized the bug reliably panics the kernel \u2014 the reported syzkaller crash is a general protection fault in `__list_del()` on `LIST_POISON` at `0xdead000000000108`, and the refcount underflow/double free corrupts the SLUB freelist; the attacker can repeat it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/9p/trans_fd.c"], "versions": [{"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "a5901a0dfb5964525990106706ae8b98db098226", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "5c64c0b7b3446f7ed088a13bc8d7487d66534cbb", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "c1db864270eb7fea94a9ef201da0c9dc1cbab7b8", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "0e0097005abc02c9f262370674f855625f4f3fb4", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "284e67a93b8c48952b6fc82129a8d3eb9dc73b06", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "448db01a48e1cdbbc31c995716a5dac1e52ba036", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "94797b84cb9985022eb9cb3275c9497fbc883bb6", "status": "affected", "versionType": "git"}, {"version": "afd8d65411551839b7ab14a539d00075b2793451", "lessThan": "674b56aa57f9379854cb6798c3bbcef7e7b51ab7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/9p/trans_fd.c"], "versions": [{"version": "3.15", "status": "affected"}, {"version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.156", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.111", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.52", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.12", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.2", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.156"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.16.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.17.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226"}, {"url": "https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb"}, {"url": "https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8"}, {"url": "https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4"}, {"url": "https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06"}, {"url": "https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6"}, {"url": "https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036"}, {"url": "https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6"}, {"url": "https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7"}], "title": "net/9p: fix double req put in p9_fd_cancelled", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/9p/trans_fd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a5901a0dfb5964525990106706ae8b98db098226", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "5c64c0b7b3446f7ed088a13bc8d7487d66534cbb", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "c1db864270eb7fea94a9ef201da0c9dc1cbab7b8", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "0e0097005abc02c9f262370674f855625f4f3fb4", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "284e67a93b8c48952b6fc82129a8d3eb9dc73b06", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "448db01a48e1cdbbc31c995716a5dac1e52ba036", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "94797b84cb9985022eb9cb3275c9497fbc883bb6", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}, {"lessThan": "674b56aa57f9379854cb6798c3bbcef7e7b51ab7", "status": "affected", "version": "afd8d65411551839b7ab14a539d00075b2793451", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/9p/trans_fd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.15"}, {"lessThan": "3.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.156", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.111", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.52", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.12", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix double req put in p9_fd_cancelled\n\nSyzkaller reports a KASAN issue as below:\n\ngeneral protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]\nCPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:__list_del include/linux/list.h:114 [inline]\nRIP: 0010:__list_del_entry include/linux/list.h:137 [inline]\nRIP: 0010:list_del include/linux/list.h:148 [inline]\nRIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734\n\nCall Trace:\n <TASK>\n p9_client_flush+0x351/0x440 net/9p/client.c:614\n p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734\n p9_client_version net/9p/client.c:920 [inline]\n p9_client_create+0xb51/0x1240 net/9p/client.c:1027\n v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408\n v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126\n legacy_get_tree+0x108/0x220 fs/fs_context.c:632\n vfs_get_tree+0x8e/0x300 fs/super.c:1573\n do_new_mount fs/namespace.c:3056 [inline]\n path_mount+0x6a6/0x1e90 fs/namespace.c:3386\n do_mount fs/namespace.c:3399 [inline]\n __do_sys_mount fs/namespace.c:3607 [inline]\n __se_sys_mount fs/namespace.c:3584 [inline]\n __x64_sys_mount+0x283/0x300 fs/namespace.c:3584\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nThis happens because of a race condition between:\n\n- The 9p client sending an invalid flush request and later cleaning it up;\n- The 9p client in p9_read_work() canceled all pending requests.\n\n Thread 1 Thread 2\n ...\n p9_client_create()\n ...\n p9_fd_create()\n ...\n p9_conn_create()\n ...\n // start Thread 2\n INIT_WORK(&m->rq, p9_read_work);\n p9_read_work()\n ...\n p9_client_rpc()\n ...\n ...\n p9_conn_cancel()\n ...\n spin_lock(&m->req_lock);\n ...\n p9_fd_cancelled()\n ...\n ...\n spin_unlock(&m->req_lock);\n // status rewrite\n p9_client_cb(m->client, req, REQ_STATUS_ERROR)\n // first remove\n list_del(&req->req_list);\n ...\n\n spin_lock(&m->req_lock)\n ...\n // second remove\n list_del(&req->req_list);\n spin_unlock(&m->req_lock)\n ...\n\nCommit 74d6a5d56629 (\"9p/trans_fd: Fix concurrency del of req_list in\np9_fd_cancelled/p9_read_work\") fixes a concurrency issue in the 9p filesystem\nclient where the req_list could be deleted simultaneously by both\np9_read_work and p9_fd_cancelled functions, but for the case where req->status\nequals REQ_STATUS_RCVD.\n\nUpdate the check for req->status in p9_fd_cancelled to skip processing not\njust received requests, but anything that is not SENT, as whatever\nchanged the state from SENT also removed the request from its list.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n[updated the check from status == RECV || status == ERROR to status != SENT]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/9p: corregir doble liberaci\u00f3n de req en p9_fd_cancelled\n\nSyzkaller informa un problema de KASAN como sigue:\n\nfallo de protecci\u00f3n general, probablemente para direcci\u00f3n no can\u00f3nica 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: quiz\u00e1s acceso a memoria salvaje en el rango [0xdead000000000108-0xdead00000000010f]\nCPU: 0 PID: 5083 Comm: syz-executor.2 No contaminado 6.1.134-syzkaller-00037-g855bd1d7d838 #0\nNombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:__list_del include/linux/list.h:114 [en l\u00ednea]\nRIP: 0010:__list_del_entry include/linux/list.h:137 [en l\u00ednea]\nRIP: 0010:list_del include/linux/list.h:148 [en l\u00ednea]\nRIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734\n\nTraza de llamada:\n <TAREA>\n p9_client_flush+0x351/0x440 net/9p/client.c:614\n p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734\n p9_client_version net/9p/client.c:920 [en l\u00ednea]\n p9_client_create+0xb51/0x1240 net/9p/client.c:1027\n v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408\n v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126\n legacy_get_tree+0x108/0x220 fs/fs_context.c:632\n vfs_get_tree+0x8e/0x300 fs/super.c:1573\n do_new_mount fs/namespace.c:3056 [en l\u00ednea]\n path_mount+0x6a6/0x1e90 fs/namespace.c:3386\n do_mount fs/namespace.c:3399 [en l\u00ednea]\n __do_sys_mount fs/namespace.c:3607 [en l\u00ednea]\n __se_sys_mount fs/namespace.c:3584 [en l\u00ednea]\n __x64_sys_mount+0x283/0x300 fs/namespace.c:3584\n do_syscall_x64 arch/x86/entry/common.c:51 [en l\u00ednea]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nEsto ocurre debido a una condici\u00f3n de carrera entre:\n\n- El cliente 9p enviando una solicitud de vaciado inv\u00e1lida y limpi\u00e1ndola posteriormente;\n- El cliente 9p en p9_read_work() cancel\u00f3 todas las solicitudes pendientes.\n\n Hilo 1 Hilo 2\n ...\n p9_client_create()\n ...\n p9_fd_create()\n ...\n p9_conn_create()\n ...\n // iniciar Hilo 2\n INIT_WORK(&m->rq, p9_read_work);\n p9_read_work()\n ...\n p9_client_rpc()\n ...\n ...\n p9_conn_cancel()\n ...\n spin_lock(&m->req_lock);\n ...\n p9_fd_cancelled()\n ...\n ...\n spin_unlock(&m->req_lock);\n // reescritura de estado\n p9_client_cb(m->client, req, REQ_STATUS_ERROR)\n // primera eliminaci\u00f3n\n list_del(&req->req_list);\n ...\n\n spin_lock(&m->req_lock)\n ...\n // segunda eliminaci\u00f3n\n list_del(&req->req_list);\n spin_unlock(&m->req_lock)\n ...\n\nEl commit 74d6a5d56629 (\u201c9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work\u201d) corrige un problema de concurrencia en el cliente del sistema de archivos 9p donde la req_list podr\u00eda ser eliminada simult\u00e1neamente por las funciones p9_read_work y p9_fd_cancelled, pero para el caso en que req->status es igual a REQ_STATUS_RCVD.\n\nActualizar la verificaci\u00f3n de req->status en p9_fd_cancelled para omitir el procesamiento no solo de las solicitudes recibidas, sino de cualquier cosa que no sea ENVIADA, ya que lo que sea que haya cambiado el estado de ENVIADA tambi\u00e9n elimin\u00f3 la solicitud de su lista.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con Syzkaller.\n\n[se actualiz\u00f3 la verificaci\u00f3n de status == RECV || status == ERROR a status != SENT]"}], "id": "CVE-2025-40027", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-28T10:15:42.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net/9p: fix double req put in p9_fd_cancelled", "id": "2406713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406713"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40027", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40027\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40027\nhttps://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40027-8088@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:58:45.790578+00:00", "updated": "2025-10-29T10:58:45.790604+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}