CVE-2025-40027 (GCVE-0-2025-40027)

Vulnerability from cvelistv5 – Published: 2025-10-28 09:32 – Updated: 2026-05-11 21:41
VLAI
Title
net/9p: fix double req put in p9_fd_cancelled
Summary
In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734 Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 This happens because of a race condition between: - The 9p client sending an invalid flush request and later cleaning it up; - The 9p client in p9_read_work() canceled all pending requests. Thread 1 Thread 2 ... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ... spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ... Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD. Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. [updated the check from status == RECV || status == ERROR to status != SENT]
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: afd8d65411551839b7ab14a539d00075b2793451 , < a5901a0dfb5964525990106706ae8b98db098226 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 5c64c0b7b3446f7ed088a13bc8d7487d66534cbb (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < c1db864270eb7fea94a9ef201da0c9dc1cbab7b8 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 0e0097005abc02c9f262370674f855625f4f3fb4 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 284e67a93b8c48952b6fc82129a8d3eb9dc73b06 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 448db01a48e1cdbbc31c995716a5dac1e52ba036 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 94797b84cb9985022eb9cb3275c9497fbc883bb6 (git)
Affected: afd8d65411551839b7ab14a539d00075b2793451 , < 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 (git)
Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.111 , ≤ 6.6.* (semver)
Unaffected: 6.12.52 , ≤ 6.12.* (semver)
Unaffected: 6.16.12 , ≤ 6.16.* (semver)
Unaffected: 6.17.2 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/9p/trans_fd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a5901a0dfb5964525990106706ae8b98db098226",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "5c64c0b7b3446f7ed088a13bc8d7487d66534cbb",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "c1db864270eb7fea94a9ef201da0c9dc1cbab7b8",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "0e0097005abc02c9f262370674f855625f4f3fb4",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "284e67a93b8c48952b6fc82129a8d3eb9dc73b06",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "448db01a48e1cdbbc31c995716a5dac1e52ba036",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "94797b84cb9985022eb9cb3275c9497fbc883bb6",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            },
            {
              "lessThan": "674b56aa57f9379854cb6798c3bbcef7e7b51ab7",
              "status": "affected",
              "version": "afd8d65411551839b7ab14a539d00075b2793451",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/9p/trans_fd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.111",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.52",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.12",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.2",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix double req put in p9_fd_cancelled\n\nSyzkaller reports a KASAN issue as below:\n\ngeneral protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]\nCPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:__list_del include/linux/list.h:114 [inline]\nRIP: 0010:__list_del_entry include/linux/list.h:137 [inline]\nRIP: 0010:list_del include/linux/list.h:148 [inline]\nRIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734\n\nCall Trace:\n \u003cTASK\u003e\n p9_client_flush+0x351/0x440 net/9p/client.c:614\n p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734\n p9_client_version net/9p/client.c:920 [inline]\n p9_client_create+0xb51/0x1240 net/9p/client.c:1027\n v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408\n v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126\n legacy_get_tree+0x108/0x220 fs/fs_context.c:632\n vfs_get_tree+0x8e/0x300 fs/super.c:1573\n do_new_mount fs/namespace.c:3056 [inline]\n path_mount+0x6a6/0x1e90 fs/namespace.c:3386\n do_mount fs/namespace.c:3399 [inline]\n __do_sys_mount fs/namespace.c:3607 [inline]\n __se_sys_mount fs/namespace.c:3584 [inline]\n __x64_sys_mount+0x283/0x300 fs/namespace.c:3584\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nThis happens because of a race condition between:\n\n- The 9p client sending an invalid flush request and later cleaning it up;\n- The 9p client in p9_read_work() canceled all pending requests.\n\n      Thread 1                              Thread 2\n    ...\n    p9_client_create()\n    ...\n    p9_fd_create()\n    ...\n    p9_conn_create()\n    ...\n    // start Thread 2\n    INIT_WORK(\u0026m-\u003erq, p9_read_work);\n                                        p9_read_work()\n    ...\n    p9_client_rpc()\n    ...\n                                        ...\n                                        p9_conn_cancel()\n                                        ...\n                                        spin_lock(\u0026m-\u003ereq_lock);\n    ...\n    p9_fd_cancelled()\n    ...\n                                        ...\n                                        spin_unlock(\u0026m-\u003ereq_lock);\n                                        // status rewrite\n                                        p9_client_cb(m-\u003eclient, req, REQ_STATUS_ERROR)\n                                        // first remove\n                                        list_del(\u0026req-\u003ereq_list);\n                                        ...\n\n    spin_lock(\u0026m-\u003ereq_lock)\n    ...\n    // second remove\n    list_del(\u0026req-\u003ereq_list);\n    spin_unlock(\u0026m-\u003ereq_lock)\n  ...\n\nCommit 74d6a5d56629 (\"9p/trans_fd: Fix concurrency del of req_list in\np9_fd_cancelled/p9_read_work\") fixes a concurrency issue in the 9p filesystem\nclient where the req_list could be deleted simultaneously by both\np9_read_work and p9_fd_cancelled functions, but for the case where req-\u003estatus\nequals REQ_STATUS_RCVD.\n\nUpdate the check for req-\u003estatus in p9_fd_cancelled to skip processing not\njust received requests, but anything that is not SENT, as whatever\nchanged the state from SENT also removed the request from its list.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\n[updated the check from status == RECV || status == ERROR to status != SENT]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:41:04.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06"
        },
        {
          "url": "https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036"
        },
        {
          "url": "https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7"
        }
      ],
      "title": "net/9p: fix double req put in p9_fd_cancelled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40027",
    "datePublished": "2025-10-28T09:32:34.162Z",
    "dateReserved": "2025-04-16T07:20:57.152Z",
    "dateUpdated": "2026-05-11T21:41:04.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40027",
      "date": "2026-07-18",
      "epss": "0.00213",
      "percentile": "0.11583"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40027\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T10:15:42.313\",\"lastModified\":\"2026-06-17T09:21:08.643\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/9p: fix double req put in p9_fd_cancelled\\n\\nSyzkaller reports a KASAN issue as below:\\n\\ngeneral protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI\\nKASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]\\nCPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\\nRIP: 0010:__list_del include/linux/list.h:114 [inline]\\nRIP: 0010:__list_del_entry include/linux/list.h:137 [inline]\\nRIP: 0010:list_del include/linux/list.h:148 [inline]\\nRIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734\\n\\nCall Trace:\\n \u003cTASK\u003e\\n p9_client_flush+0x351/0x440 net/9p/client.c:614\\n p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734\\n p9_client_version net/9p/client.c:920 [inline]\\n p9_client_create+0xb51/0x1240 net/9p/client.c:1027\\n v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408\\n v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126\\n legacy_get_tree+0x108/0x220 fs/fs_context.c:632\\n vfs_get_tree+0x8e/0x300 fs/super.c:1573\\n do_new_mount fs/namespace.c:3056 [inline]\\n path_mount+0x6a6/0x1e90 fs/namespace.c:3386\\n do_mount fs/namespace.c:3399 [inline]\\n __do_sys_mount fs/namespace.c:3607 [inline]\\n __se_sys_mount fs/namespace.c:3584 [inline]\\n __x64_sys_mount+0x283/0x300 fs/namespace.c:3584\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\\n\\nThis happens because of a race condition between:\\n\\n- The 9p client sending an invalid flush request and later cleaning it up;\\n- The 9p client in p9_read_work() canceled all pending requests.\\n\\n      Thread 1                              Thread 2\\n    ...\\n    p9_client_create()\\n    ...\\n    p9_fd_create()\\n    ...\\n    p9_conn_create()\\n    ...\\n    // start Thread 2\\n    INIT_WORK(\u0026m-\u003erq, p9_read_work);\\n                                        p9_read_work()\\n    ...\\n    p9_client_rpc()\\n    ...\\n                                        ...\\n                                        p9_conn_cancel()\\n                                        ...\\n                                        spin_lock(\u0026m-\u003ereq_lock);\\n    ...\\n    p9_fd_cancelled()\\n    ...\\n                                        ...\\n                                        spin_unlock(\u0026m-\u003ereq_lock);\\n                                        // status rewrite\\n                                        p9_client_cb(m-\u003eclient, req, REQ_STATUS_ERROR)\\n                                        // first remove\\n                                        list_del(\u0026req-\u003ereq_list);\\n                                        ...\\n\\n    spin_lock(\u0026m-\u003ereq_lock)\\n    ...\\n    // second remove\\n    list_del(\u0026req-\u003ereq_list);\\n    spin_unlock(\u0026m-\u003ereq_lock)\\n  ...\\n\\nCommit 74d6a5d56629 (\\\"9p/trans_fd: Fix concurrency del of req_list in\\np9_fd_cancelled/p9_read_work\\\") fixes a concurrency issue in the 9p filesystem\\nclient where the req_list could be deleted simultaneously by both\\np9_read_work and p9_fd_cancelled functions, but for the case where req-\u003estatus\\nequals REQ_STATUS_RCVD.\\n\\nUpdate the check for req-\u003estatus in p9_fd_cancelled to skip processing not\\njust received requests, but anything that is not SENT, as whatever\\nchanged the state from SENT also removed the request from its list.\\n\\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\\n\\n[updated the check from status == RECV || status == ERROR to status != SENT]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/9p/trans_fd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"a5901a0dfb5964525990106706ae8b98db098226\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"5c64c0b7b3446f7ed088a13bc8d7487d66534cbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"c1db864270eb7fea94a9ef201da0c9dc1cbab7b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"0e0097005abc02c9f262370674f855625f4f3fb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"284e67a93b8c48952b6fc82129a8d3eb9dc73b06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"448db01a48e1cdbbc31c995716a5dac1e52ba036\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"94797b84cb9985022eb9cb3275c9497fbc883bb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afd8d65411551839b7ab14a539d00075b2793451\",\"lessThan\":\"674b56aa57f9379854cb6798c3bbcef7e7b51ab7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/9p/trans_fd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.301\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.195\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.156\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.111\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.52\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.12\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.2\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T10:27:49+00:00",
      "cve": "CVE-2025-40027",
      "id": "CVE-2025-40027",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Denial of Service in 9p filesystem client via race condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40027.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.