CVE-2025-40047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.156Z", "datePublished": "2025-10-28T11:48:24.625Z", "dateUpdated": "2026-08-05T12:07:20.600Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:20.600Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: always prune wait queue entry in io_waitid_wait()\n\nFor a successful return, always remove our entry from the wait queue\nentry list. Previously this was skipped if a cancelation was in\nprogress, but this can race with another invocation of the wait queue\nentry callback."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the io_uring syscall interface (`io_uring_setup`/`io_uring_enter` submitting an `IORING_OP_WAITID` SQE) plus process-management signals, all of which require local access to the system. Per kernel scoring guidance, io_uring bugs are Local.\nAC:L - The attacker controls both sides of the race: it drives the wait-queue wakeups at arbitrary rate by forking children and looping SIGSTOP/SIGCONT (`do_notify_parent_cldstop` \u2192 `__wake_up_parent`), while concurrently submitting `IORING_OP_ASYNC_CANCEL` or tearing down the ring from another thread to grab the competing reference. syzbot produced a working reproducer and confirmed the fix, showing the window is hit reliably.\nPR:L - Any unprivileged local user can create an io_uring ring \u2014 `sysctl_io_uring_disabled` defaults to 0 and `IORING_OP_WAITID` carries no capability check \u2014 and waiting on one's own forked children needs no privilege at all. No capabilities, user namespaces, or root are required.\nUI:N - The attacker's own process performs every step: submitting the waitid SQE, forking and signalling the children that generate wakeups, and issuing the concurrent cancel. No action by any other user is needed.\nS:U - The use-after-free corrupts kernel heap memory and control flow within the same kernel security authority, yielding standard local privilege escalation. No VM, IOMMU, or other security-boundary crossing is involved.\nC:H - This is a use-after-free on a `struct io_waitid_async` allocated from a general-purpose kmalloc slab, which the attacker can reclaim and shape via heap spraying. The stale wait-queue entry is then dereferenced by `__wake_up_common()` and `list_del_init()`, giving a read primitive over reclaimed kernel memory that can be leveraged for arbitrary kernel memory disclosure.\nI:H - `list_del_init()` on the freed entry performs `prev->next = next; next->prev = prev` using pointers read from attacker-reclaimed memory, yielding a controlled write of a controlled pointer to a controlled address. Additionally `__wake_up_common()` calls `curr->func(...)` on the freed entry, providing a direct indirect-call/control-flow hijack primitive leading to kernel code execution.\nA:H - Even without weaponization, the dangling wait-queue entry and the list-corrupting `list_del_init()` on freed memory produce KASAN splats, list debug BUGs, and kernel oopses/panics \u2014 this is exactly how syzbot detected it. The race can be re-triggered in a tight loop, so an unprivileged user can crash the machine at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/waitid.c"], "versions": [{"version": "f31ecf671ddc498f20219453395794ff2383e06b", "lessThan": "696ba6032081e617564a8113a001b8d7943cb928", "status": "affected", "versionType": "git"}, {"version": "f31ecf671ddc498f20219453395794ff2383e06b", "lessThan": "3e2205db2f0608898d535da1964e1b376aacfdaa", "status": "affected", "versionType": "git"}, {"version": "f31ecf671ddc498f20219453395794ff2383e06b", "lessThan": "2f8229d53d984c6a05b71ac9e9583d4354e3b91f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/waitid.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/696ba6032081e617564a8113a001b8d7943cb928"}, {"url": "https://git.kernel.org/stable/c/3e2205db2f0608898d535da1964e1b376aacfdaa"}, {"url": "https://git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f"}], "title": "io_uring/waitid: always prune wait queue entry in io_waitid_wait()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/waitid.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "696ba6032081e617564a8113a001b8d7943cb928", "status": "affected", "version": "f31ecf671ddc498f20219453395794ff2383e06b", "versionType": "git"}, {"lessThan": "3e2205db2f0608898d535da1964e1b376aacfdaa", "status": "affected", "version": "f31ecf671ddc498f20219453395794ff2383e06b", "versionType": "git"}, {"lessThan": "2f8229d53d984c6a05b71ac9e9583d4354e3b91f", "status": "affected", "version": "f31ecf671ddc498f20219453395794ff2383e06b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/waitid.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: always prune wait queue entry in io_waitid_wait()\n\nFor a successful return, always remove our entry from the wait queue\nentry list. Previously this was skipped if a cancelation was in\nprogress, but this can race with another invocation of the wait queue\nentry callback."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nio_uring/waitid: siempre podar la entrada de la cola de espera en io_waitid_wait()\n\nPara un retorno exitoso, siempre eliminar nuestra entrada de la lista de entradas de la cola de espera. Anteriormente esto se omit\u00eda si una cancelaci\u00f3n estaba en curso, pero esto puede competir con otra invocaci\u00f3n de la funci\u00f3n de devoluci\u00f3n de llamada de la entrada de la cola de espera."}], "id": "CVE-2025-40047", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-28T12:15:38.793", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e2205db2f0608898d535da1964e1b376aacfdaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/696ba6032081e617564a8113a001b8d7943cb928"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait()", "id": "2406758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406758"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40047\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40047\nhttps://lore.kernel.org/linux-cve-announce/2025102813-CVE-2025-40047-b952@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:57:48.214058+00:00", "updated": "2025-10-29T10:57:48.214082+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}