PT-2025-44094 · Linux+3 · Linux Kernel+3
Published
2025-07-15
·
Updated
2026-05-26
·
CVE-2025-40027
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.134-syzkaller-00037-g855bd1d7d838
Description
The 9p filesystem client in the Linux kernel contained a race condition where the
req list could be deleted simultaneously by both the p9 read work and p9 fd cancelled functions. This occurred when a 9p client sent an invalid flush request and later cleaned it up, or when the 9p client in p9 read work canceled all pending requests. Specifically, the issue stemmed from a double deletion of a request from the req list due to concurrent access and modification of the list under a spinlock. The vulnerability was discovered by Linux Verification Center (linuxtesting.org) using Syzkaller. The fix involves updating the check in p9 fd cancelled to skip processing requests that are not in the SENT state, as any state change from SENT also removes the request from its list.Recommendations
Update the Linux kernel to version 6.1.134-syzkaller-00037-g855bd1d7d838 or later.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu