Vulnerability-Lookup

FKIE_CVE-2025-40249

Vulnerability from fkie_nvd - Published: 2025-12-04 16:16 - Updated: 2026-10-19 21:10

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dccc6daa8afa0f64c432e4c867f275747e3415e1",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            },
            {
              "lessThan": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It\u0027s possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: cdev: asegurar que el fd del cdev sigue activo antes de emitir eventos\n\nCon la llamada final a fput() en un descriptor de archivo, la acci\u00f3n de liberaci\u00f3n puede ser diferida y programada en una cola de trabajo. El contador de referencias de ese descriptor sigue siendo cero y no debe ser usado. Es posible que un cambio de GPIO, sobre el cual queremos notificar al espacio de usuario, ocurra DESPU\u00c9S de que el contador de referencias en el descriptor de archivo asociado con el dispositivo de caracteres baj\u00f3 a cero, pero ANTES de que la devoluci\u00f3n de llamada .release() fuera invocada desde la cola de trabajo y, por lo tanto, ANTES de que nos desregistr\u00e1ramos del notificador.\n\nUsar la rutina get_file() regular en esta situaci\u00f3n desencadena la siguiente advertencia:\n\n  struct file::f_count incrementado desde cero; \u00a1condici\u00f3n de uso despu\u00e9s de liberaci\u00f3n presente!\n\nAs\u00ed que usar la variante get_file_active() que devolver\u00e1 NULL en descriptores de archivo que han sido o est\u00e1n siendo liberados."
    }
  ],
  "id": "CVE-2025-40249",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-04T16:16:18.380",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2025-40249 (GCVE-0-2025-40249)

Vulnerability from cvelistv5 – Published: 2025-12-04 16:08 – Updated: 2026-08-05 12:08

Title

gpio: cdev: make sure the cdev fd is still active before emitting events

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6847 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/dccc6daa8afa0f64c…
https://git.kernel.org/stable/c/d4cd0902c156b2ca6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 40b7c49950bd56c984b1f6722f865b922879260e , < dccc6daa8afa0f64c432e4c867f275747e3415e1 (git) Affected: 40b7c49950bd56c984b1f6722f865b922879260e , < d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.17.10 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dccc6daa8afa0f64c432e4c867f275747e3415e1",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            },
            {
              "lessThan": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It\u0027s possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the GPIO character device `/dev/gpiochipN` via `open()`, `ioctl()` and `close()`, requiring local access to the system. There is no network-facing path to the GPIO line-state notifier chain.\nAC:L - The attacker controls both sides of the race \u2014 one thread loops open/`GPIO_V2_GET_LINEINFO_WATCH_IOCTL`/close while another loops line request/release/set-config to fire `gpiod_line_state_notify()` \u2014 and can retry indefinitely; the fput-to-release window can additionally be stretched to a full jiffy by forcing the `schedule_delayed_work(\u0026delayed_fput_work, 1)` path, and the reporter hit the condition during normal operation.\nPR:L - No capability check exists anywhere in `gpio_chrdev_open()` or `gpio_ioctl()` \u2014 only file permissions on `/dev/gpiochipN`, which embedded, IoT, automotive and Raspberry-Pi-class deployments routinely grant to a non-root `gpio` group or to unprivileged libgpiod control daemons. A basic unprivileged local account with that group membership is sufficient.\nUI:N - The attacker performs every step itself \u2014 opening the chardev, arming the line watch, generating the line-state change, and closing the fd. No victim action or cooperation is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on both the `struct file` and the ~9.4 KB `gpio_chardev_data` object; a resprayed `cdev` lets `kfifo_in_spinlocked()` and `fput(cdev-\u003efp)` read through attacker-chosen pointers, and `wake_up_poll()` on the freed wait queue yields a controlled call primitive, enabling arbitrary kernel memory disclosure.\nI:H - The queued work writes a 288-byte event record (with an attacker-supplied 32-byte consumer label) through the freed object\u0027s kfifo `data` pointer and performs a refcount decrement through a dangling `struct file *`, giving arbitrary-write and function-pointer-hijack primitives suitable for privilege escalation.\nA:H - In the common case the bug produces a `refcount_t` WARN (\"f_count incremented from zero; use-after-free condition present!\") \u2014 an immediate panic under `panic_on_warn` \u2014 followed by use-after-free accesses to a freed spinlock, kfifo and wait queue that reliably oops or panic the kernel, and the sequence is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:51.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64"
        }
      ],
      "title": "gpio: cdev: make sure the cdev fd is still active before emitting events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40249",
    "datePublished": "2025-12-04T16:08:12.206Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:51.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted