CVE-2025-40039 (GCVE-0-2025-40039)
Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
EPSS
VEX
Title
ksmbd: Fix race condition in RPC handle list access
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Fix race condition in RPC handle list access
The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd
session. Access to this list is intended to be protected by
'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was
flawed, leading to potential race conditions.
In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock
before calling xa_store() and xa_erase(). Since these operations modify
the XArray structure, a write lock is required to ensure exclusive access
and prevent data corruption from concurrent modifications.
Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()
without holding any lock at all. This could lead to reading inconsistent
data or a potential use-after-free if an entry is concurrently removed and
the pointer is dereferenced.
Fix these issues by:
1. Using down_write() and up_write() in ksmbd_session_rpc_open()
to ensure exclusive access during XArray modification, and ensuring
the lock is correctly released on error paths.
2. Adding down_read() and up_read() in ksmbd_session_rpc_method()
to safely protect the lookup.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
a4348710a7267705b75692dc1a000920481d1d92 , < 69674b029002b1d90b655f014bdf64f404efa54d
(git)
Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 6b615a8fb3af0baf8126cde3d4fee97d57222ffc (git) Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 (git) Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 (git) Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 305853cce379407090a73b38c5de5ba748893aee (git) Affected: 1f485b54d04a920723984062c912174330a05178 (git) Affected: 052b41ef2abe274f068e892aee81406f11bd1f3a (git) Affected: 5.15.145 , < 5.16 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.123 , ≤ 6.6.* (semver) Unaffected: 6.12.53 , ≤ 6.12.* (semver) Unaffected: 6.17.3 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "69674b029002b1d90b655f014bdf64f404efa54d",
"status": "affected",
"version": "a4348710a7267705b75692dc1a000920481d1d92",
"versionType": "git"
},
{
"lessThan": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
"status": "affected",
"version": "b685757c7b08d5073046fb379be965fd6c06aafc",
"versionType": "git"
},
{
"lessThan": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
"status": "affected",
"version": "b685757c7b08d5073046fb379be965fd6c06aafc",
"versionType": "git"
},
{
"lessThan": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
"status": "affected",
"version": "b685757c7b08d5073046fb379be965fd6c06aafc",
"versionType": "git"
},
{
"lessThan": "305853cce379407090a73b38c5de5ba748893aee",
"status": "affected",
"version": "b685757c7b08d5073046fb379be965fd6c06aafc",
"versionType": "git"
},
{
"status": "affected",
"version": "1f485b54d04a920723984062c912174330a05178",
"versionType": "git"
},
{
"status": "affected",
"version": "052b41ef2abe274f068e892aee81406f11bd1f3a",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.123",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.123",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.53",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix race condition in RPC handle list access\n\nThe \u0027sess-\u003erpc_handle_list\u0027 XArray manages RPC handles within a ksmbd\nsession. Access to this list is intended to be protected by\n\u0027sess-\u003erpc_lock\u0027 (an rw_semaphore). However, the locking implementation was\nflawed, leading to potential race conditions.\n\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\nbefore calling xa_store() and xa_erase(). Since these operations modify\nthe XArray structure, a write lock is required to ensure exclusive access\nand prevent data corruption from concurrent modifications.\n\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\nwithout holding any lock at all. This could lead to reading inconsistent\ndata or a potential use-after-free if an entry is concurrently removed and\nthe pointer is dereferenced.\n\nFix these issues by:\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\n to ensure exclusive access during XArray modification, and ensuring\n the lock is correctly released on error paths.\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\n to safely protect the lookup."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in ksmbd, the in-kernel SMB server, and is driven entirely by SMB2 requests (CREATE/CLOSE/IOCTL/READ/WRITE/QUERY_INFO) arriving over TCP port 445 from a remote peer. No local access is needed.\nAC:L - The attacker controls both sides of the race: the pipe handle is an attacker-chosen VolatileFileId, and ksmbd_queue_work() executes each SMB2 request on a separate ksmbd-io worker (plus SMB3 multichannel), so concurrent SMB2_CLOSE and SMB2_IOCTL/READ/WRITE requests run in parallel with unlimited retries.\nPR:L - Reaching create_smb2_pipe() requires a session in SMB2_SESSION_VALID state (ksmbd_session_lookup_all() rejects IN_PROGRESS) plus a tree connect to IPC$, i.e. any valid low-privileged SMB account; no administrative rights are needed, and with guest mapping enabled even credentials are unnecessary.\nUI:N - The entire sequence is performed by the attacker\u0027s own SMB client against the server; no action by any local user or administrator is required.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unlocked xa_load() dereferences a kfree()\u0027d struct ksmbd_session_rpc, disclosing reused kernel heap contents as the RPC method flags; a UAF of this kind gives control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure, and the resulting flags can steer the root ksmbd.mountd daemon into SAMR/LSARPC handlers the client never opened.\nI:H - The stale entry-\u003emethod value read from a reused 8-byte slab object is heap-groomable by the attacker and directly selects which privileged RPC method the root-privileged userspace daemon executes with client-supplied payload; use-after-free conditions are generally leverageable into arbitrary-write and control-flow hijack primitives.\nA:H - Dereferencing the freed entry after the slab object or page has been released oopses the ksmbd worker thread, and the unsynchronized RPC handle teardown corrupts session state, yielding a repeatable remote kernel crash / denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:07:13.052Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d"
},
{
"url": "https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc"
},
{
"url": "https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3"
},
{
"url": "https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1"
},
{
"url": "https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee"
}
],
"title": "ksmbd: Fix race condition in RPC handle list access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40039",
"datePublished": "2025-10-28T11:48:19.781Z",
"dateReserved": "2025-04-16T07:20:57.153Z",
"dateUpdated": "2026-08-05T12:07:13.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-40039",
"date": "2026-09-17",
"epss": "0.00301",
"percentile": "0.22885"
},
"microsoft_vex": {
"current_release_date": "2026-03-31T15:16:27.000Z",
"cve": "CVE-2025-40039",
"id": "msrc_CVE-2025-40039",
"initial_release_date": "2025-10-02T00:00:00.000Z",
"product_status:known_affected": "3",
"product_status:known_not_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "ksmbd: Fix race condition in RPC handle list access",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40039.json",
"version": "5"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-40039\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:37.847\",\"lastModified\":\"2026-07-30T06:24:07.150\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: Fix race condition in RPC handle list access\\n\\nThe \u0027sess-\u003erpc_handle_list\u0027 XArray manages RPC handles within a ksmbd\\nsession. Access to this list is intended to be protected by\\n\u0027sess-\u003erpc_lock\u0027 (an rw_semaphore). However, the locking implementation was\\nflawed, leading to potential race conditions.\\n\\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\\nbefore calling xa_store() and xa_erase(). Since these operations modify\\nthe XArray structure, a write lock is required to ensure exclusive access\\nand prevent data corruption from concurrent modifications.\\n\\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\\nwithout holding any lock at all. This could lead to reading inconsistent\\ndata or a potential use-after-free if an entry is concurrently removed and\\nthe pointer is dereferenced.\\n\\nFix these issues by:\\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\\n to ensure exclusive access during XArray modification, and ensuring\\n the lock is correctly released on error paths.\\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\\n to safely protect the lookup.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/mgmt/user_session.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a4348710a7267705b75692dc1a000920481d1d92\",\"lessThan\":\"69674b029002b1d90b655f014bdf64f404efa54d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"6b615a8fb3af0baf8126cde3d4fee97d57222ffc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"5cc679ba0f4505936124cd4179ba66bb0a4bd9f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"305853cce379407090a73b38c5de5ba748893aee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1f485b54d04a920723984062c912174330a05178\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"052b41ef2abe274f068e892aee81406f11bd1f3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.145\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/mgmt/user_session.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.123\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.145\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.71\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"163E72B5-0F5D-49E2-AAEA-F11E02D730AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.123\",\"matchCriteriaId\":\"F522E23F-2E27-4FDC-A9A5-FE6B600E1D7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.53\",\"matchCriteriaId\":\"A9028AC3-C3E8-4D5D-9235-DE8859551F7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.17.3\",\"matchCriteriaId\":\"F55A160F-1578-4C10-ABCB-F90B7E146ED8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-06-30T10:34:09+00:00",
"cve": "CVE-2025-40039",
"id": "CVE-2025-40039",
"initial_release_date": "2025-10-28T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ksmbd: Fix race condition in RPC handle list access",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40039.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…