CVE-2025-40108
BaseFortify
Publication date: 2025-11-09
Last updated on: 2025-11-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17.0-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a bug in the Linux kernel's Qualcomm serial driver (qcom-geni) that causes a task to become blocked or hang during normal boot on certain Qualcomm hardware (specifically the RB1 board, QRB2210). The issue was introduced by enabling power management runtime for the serial driver, which led to a regression where the kernel worker task gets stuck for an extended period, making the serial interface unusable during boot. The fix involved reverting the problematic commits that caused this hang.
How can this vulnerability impact me? :
This vulnerability can cause the system to hang or block a kernel worker task during boot, specifically affecting the serial interface on Qualcomm RB1 hardware. This means that the serial port may become unusable during normal system startup, potentially preventing communication or debugging via serial console and impacting system reliability and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing blocked tasks related to the Qualcomm serial driver in the Linux kernel logs. Specifically, look for messages indicating a task such as 'kworker/u16:0' being blocked for more than 42 seconds. You can check kernel logs using commands like 'dmesg | grep kworker' or 'journalctl -k | grep kworker'. Additionally, monitoring for the specific hung task message can help identify the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves reverting the problematic commits that introduced the issue, specifically commit 1afa70632c39 and its dependent commit 86fa39dd6fb7, as these cause the task hang on Qualcomm RB1 boards. Alternatively, you can disable the hung task warning by running 'echo 0 > /proc/sys/kernel/hung_task_timeout_secs' to suppress the message temporarily, but this does not fix the underlying issue. The best approach is to apply the fix that removes or reverts the faulty commits.