CVE-2025-40347

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40347", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.187Z", "datePublished": "2025-12-16T13:30:21.539Z", "dateUpdated": "2026-08-05T12:09:48.141Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:48.141Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n -> enetc_lock_mdio\n -> enetc_clean_rx_ring OR napi_complete_done\n -> napi_gro_receive\n -> enetc_start_xmit\n -> enetc_lock_mdio\n -> enetc_map_tx_buffs\n -> enetc_unlock_mdio\n -> enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The deadlock is driven from the enetc RX datapath (`enetc_poll` \u2192 `napi_gro_receive` \u2192 stack \u2192 `enetc_start_xmit`), reached purely by packets arriving on the Ethernet interface, including routed IP traffic from arbitrary remote networks. No L2 adjacency or local access is needed \u2014 a plain ICMP/TCP flow that elicits a reply or is forwarded suffices.\nAC:L - The attacker directly creates the recursive read-lock condition by sustaining inbound traffic that triggers a transmit from within the RX softirq, and the competing MDIO writer occurs many times per second from the periodic phylib/phylink state machine, so the collision is reached reliably within seconds and can be retried indefinitely.\nPR:N - The vulnerable path is the unauthenticated packet-receive path of the NIC driver; no credentials, capabilities, or local account are required \u2014 merely sending traffic to (or through) the affected interface is enough.\nUI:N - No victim action is needed; the deadlock arises from normal kernel-side packet processing and background PHY polling that run without any user involvement.\nS:U - The lock inversion hangs kernel threads within the same security authority as the affected kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is a pure lock-ordering/recursion defect with no memory corruption, out-of-bounds access, or exposure of kernel data to the attacker.\nI:N - No data is modified and no write primitive is produced; the failure mode is threads blocking on an rt_mutex-backed rwlock, not memory corruption.\nA:H - The recursive read-lock acquisition deadlocks the NAPI poll thread against a waiting MDIO writer, producing RCU stalls, hung tasks, and permanent loss of network processing on the interface \u2014 a remotely inducible, unrecoverable denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/freescale/enetc/enetc.c"], "versions": [{"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "lessThan": "a649161526736f48bcc592e3a412e5bcd7dd9e24", "status": "affected", "versionType": "git"}, {"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "lessThan": "2781ca82ce8cad263d80b617addb727e6a84c9e5", "status": "affected", "versionType": "git"}, {"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "lessThan": "1f92f5bd057a4fad9dab6af17963cdd21e5da6ed", "status": "affected", "versionType": "git"}, {"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "lessThan": "2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa", "status": "affected", "versionType": "git"}, {"version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "lessThan": "50bd33f6b3922a6b760aa30d409cae891cec8fb5", "status": "affected", "versionType": "git"}, {"version": "bf9c564716a13dde6a990d3b02c27cd6e39608bf", "status": "affected", "versionType": "git"}, {"version": "ff966263f5f9fdf9740f03fed0762ce73c230a6a", "status": "affected", "versionType": "git"}, {"version": "5.10.24", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.11.7", "lessThan": "5.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/freescale/enetc/enetc.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.115", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.56", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.17.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"}, {"url": "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"}, {"url": "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"}, {"url": "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"}, {"url": "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"}], "title": "net: enetc: fix the deadlock of enetc_mdio_lock", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/freescale/enetc/enetc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a649161526736f48bcc592e3a412e5bcd7dd9e24", "status": "affected", "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "versionType": "git"}, {"lessThan": "2781ca82ce8cad263d80b617addb727e6a84c9e5", "status": "affected", "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "versionType": "git"}, {"lessThan": "1f92f5bd057a4fad9dab6af17963cdd21e5da6ed", "status": "affected", "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "versionType": "git"}, {"lessThan": "2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa", "status": "affected", "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "versionType": "git"}, {"lessThan": "50bd33f6b3922a6b760aa30d409cae891cec8fb5", "status": "affected", "version": "6d36ecdbc4410e61a0e02adc5d3abeee22a8ffd3", "versionType": "git"}, {"status": "affected", "version": "bf9c564716a13dde6a990d3b02c27cd6e39608bf", "versionType": "git"}, {"status": "affected", "version": "ff966263f5f9fdf9740f03fed0762ce73c230a6a", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.24", "versionType": "semver"}, {"lessThan": "5.12", "status": "affected", "version": "5.11.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/freescale/enetc/enetc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.115", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.56", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: fix the deadlock of enetc_mdio_lock\n\nAfter applying the workaround for err050089, the LS1028A platform\nexperiences RCU stalls on RT kernel. This issue is caused by the\nrecursive acquisition of the read lock enetc_mdio_lock. Here list some\nof the call stacks identified under the enetc_poll path that may lead to\na deadlock:\n\nenetc_poll\n -> enetc_lock_mdio\n -> enetc_clean_rx_ring OR napi_complete_done\n -> napi_gro_receive\n -> enetc_start_xmit\n -> enetc_lock_mdio\n -> enetc_map_tx_buffs\n -> enetc_unlock_mdio\n -> enetc_unlock_mdio\n\nAfter enetc_poll acquires the read lock, a higher-priority writer attempts\nto acquire the lock, causing preemption. The writer detects that a\nread lock is already held and is scheduled out. However, readers under\nenetc_poll cannot acquire the read lock again because a writer is already\nwaiting, leading to a thread hang.\n\nCurrently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent\nrecursive lock acquisition."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: enetc: corregir el interbloqueo de enetc_mdio_lock\n\nDespu\u00e9s de aplicar la soluci\u00f3n alternativa para err050089, la plataforma LS1028A experimenta bloqueos RCU en el kernel RT. Este problema es causado por la adquisici\u00f3n recursiva del bloqueo de lectura enetc_mdio_lock. Aqu\u00ed se enumeran algunas de las pilas de llamadas identificadas bajo la ruta enetc_poll que pueden conducir a un interbloqueo:\n\nenetc_poll\n -> enetc_lock_mdio\n -> enetc_clean_rx_ring OR napi_complete_done\n -> napi_gro_receive\n -> enetc_start_xmit\n -> enetc_lock_mdio\n -> enetc_map_tx_buffs\n -> enetc_unlock_mdio\n -> enetc_unlock_mdio\n\nDespu\u00e9s de que enetc_poll adquiere el bloqueo de lectura, un escritor de mayor prioridad intenta adquirir el bloqueo, causando la expropiaci\u00f3n. El escritor detecta que un bloqueo de lectura ya est\u00e1 retenido y es desprogramado. Sin embargo, los lectores bajo enetc_poll no pueden adquirir el bloqueo de lectura de nuevo porque un escritor ya est\u00e1 esperando, lo que lleva a un cuelgue del hilo.\n\nActualmente, el interbloqueo se evita ajustando enetc_lock_mdio para prevenir la adquisici\u00f3n recursiva del bloqueo."}], "id": "CVE-2025-40347", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-16T14:15:46.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f92f5bd057a4fad9dab6af17963cdd21e5da6ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2781ca82ce8cad263d80b617addb727e6a84c9e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e55a49dc3b2a6b23329e4fbbd8a5feb20e220aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50bd33f6b3922a6b760aa30d409cae891cec8fb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a649161526736f48bcc592e3a412e5bcd7dd9e24"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: enetc: fix the deadlock of enetc_mdio_lock", "id": "2422720", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422720"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40347", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40347\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40347\nhttps://lore.kernel.org/linux-cve-announce/2025121634-CVE-2025-40347-275c@gregkh/T"], "threat_severity": "Important"}

{}