PT-2025-44380 · Linux+1 · Linux Kernel+1

Published 2025-10-30 · Updated 2026-03-07 · CVE-2025-40090

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s ksmbd component contains a flaw related to recursive locking within RPC handle list access. Specifically, the ksmbd session rpc method() function attempts to lock sess->rpc lock, which can lead to hung connections or tasks when a client attempts to open a named pipe. This issue arises from a deadlock situation where a write lock is acquired in ksmbd session rpc open, and a read lock is subsequently attempted in ksmbd session rpc method, resulting in a deadlock. The issue was identified after commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"). Exploitation can be demonstrated using Samba’s rpcclient tool, where a connection may hang when attempting to retrieve server information. The call trace indicates the deadlock occurs within the ksmbd-io workqueue, specifically in the handle ksmbd work function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-40090

OPENSUSE-SU-2025:15702-1

OPENSUSE-SU-2026:10301-1

Affected Products

Linux Kernel

Samba Rpcclient

References · 218

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40090.json · Exploit
• https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36 · Patch
• https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4 · Patch
• https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:15702-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40090 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40090 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40090 · Security Note
• https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02 · Patch
• https://osv.dev/vulnerability/CVE-2025-40090 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-40090 · Vendor Advisory
• https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10301-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-68351 · Note