CVE-2025-40090
BaseFortify
Publication date: 2025-10-30
Last updated on: 2026-02-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | From 6.12.53 (inc) to 6.12.55 (exc) |
| linux | linux_kernel | From 6.17.3 (inc) to 6.17.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a deadlock issue in the Linux kernel's ksmbd component. Specifically, ksmbd_session_rpc_method() tries to acquire a read lock on sess->rpc_lock while the same lock is already held for writing by ksmbd_session_rpc_open, causing recursive locking and resulting in hung connections or tasks when a client attempts to open a named pipe via Samba's rpcclient tool.
How can this vulnerability impact me? :
The vulnerability can cause hung connections or tasks on the system when clients try to open named pipes using Samba's rpcclient. This leads to deadlocks in the kernel, potentially causing service disruptions or degraded performance in environments relying on ksmbd for SMB protocol handling.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing hung connections or tasks when a client attempts to open a named pipe using Samba's rpcclient tool. For example, running the command: $ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo will cause the connection to hang if the vulnerability is present. On the kernel side, hung tasks related to ksmbd workqueue can be identified in kernel logs, showing stack traces involving ksmbd_session_rpc_method and related functions.
What immediate steps should I take to mitigate this vulnerability?
An immediate mitigation step is to disable the kernel hung task timeout message by running: echo 0 > /proc/sys/kernel/hung_task_timeout_secs This prevents the hung task message but does not fix the underlying deadlock. The proper fix involves adjusting ksmbd_session_rpc_method() callers to take the lock when necessary, which requires applying the relevant kernel patch or update.