GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40047 (GCVE-0-2025-40047)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
io_uring/waitid: always prune wait queue entry in io_waitid_wait()
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 696ba6032081e617564a8113a001b8d7943cb928 (git)
Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 3e2205db2f0608898d535da1964e1b376aacfdaa (git)
Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 2f8229d53d984c6a05b71ac9e9583d4354e3b91f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "696ba6032081e617564a8113a001b8d7943cb928",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            },
            {
              "lessThan": "3e2205db2f0608898d535da1964e1b376aacfdaa",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            },
            {
              "lessThan": "2f8229d53d984c6a05b71ac9e9583d4354e3b91f",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: always prune wait queue entry in io_waitid_wait()\n\nFor a successful return, always remove our entry from the wait queue\nentry list. Previously this was skipped if a cancelation was in\nprogress, but this can race with another invocation of the wait queue\nentry callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the io_uring syscall interface (`io_uring_setup`/`io_uring_enter` submitting an `IORING_OP_WAITID` SQE) plus process-management signals, all of which require local access to the system. Per kernel scoring guidance, io_uring bugs are Local.\nAC:L - The attacker controls both sides of the race: it drives the wait-queue wakeups at arbitrary rate by forking children and looping SIGSTOP/SIGCONT (`do_notify_parent_cldstop` \u2192 `__wake_up_parent`), while concurrently submitting `IORING_OP_ASYNC_CANCEL` or tearing down the ring from another thread to grab the competing reference. syzbot produced a working reproducer and confirmed the fix, showing the window is hit reliably.\nPR:L - Any unprivileged local user can create an io_uring ring \u2014 `sysctl_io_uring_disabled` defaults to 0 and `IORING_OP_WAITID` carries no capability check \u2014 and waiting on one\u0027s own forked children needs no privilege at all. No capabilities, user namespaces, or root are required.\nUI:N - The attacker\u0027s own process performs every step: submitting the waitid SQE, forking and signalling the children that generate wakeups, and issuing the concurrent cancel. No action by any other user is needed.\nS:U - The use-after-free corrupts kernel heap memory and control flow within the same kernel security authority, yielding standard local privilege escalation. No VM, IOMMU, or other security-boundary crossing is involved.\nC:H - This is a use-after-free on a `struct io_waitid_async` allocated from a general-purpose kmalloc slab, which the attacker can reclaim and shape via heap spraying. The stale wait-queue entry is then dereferenced by `__wake_up_common()` and `list_del_init()`, giving a read primitive over reclaimed kernel memory that can be leveraged for arbitrary kernel memory disclosure.\nI:H - `list_del_init()` on the freed entry performs `prev-\u003enext = next; next-\u003eprev = prev` using pointers read from attacker-reclaimed memory, yielding a controlled write of a controlled pointer to a controlled address. Additionally `__wake_up_common()` calls `curr-\u003efunc(...)` on the freed entry, providing a direct indirect-call/control-flow hijack primitive leading to kernel code execution.\nA:H - Even without weaponization, the dangling wait-queue entry and the list-corrupting `list_del_init()` on freed memory produce KASAN splats, list debug BUGs, and kernel oopses/panics \u2014 this is exactly how syzbot detected it. The race can be re-triggered in a tight loop, so an unprivileged user can crash the machine at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:20.600Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/696ba6032081e617564a8113a001b8d7943cb928"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e2205db2f0608898d535da1964e1b376aacfdaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f"
        }
      ],
      "title": "io_uring/waitid: always prune wait queue entry in io_waitid_wait()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40047",
    "datePublished": "2025-10-28T11:48:24.625Z",
    "dateReserved": "2025-04-16T07:20:57.156Z",
    "dateUpdated": "2026-08-05T12:07:20.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40047",
      "date": "2026-09-19",
      "epss": "0.00152",
      "percentile": "0.04786"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "io_uring/waitid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "696ba6032081e617564a8113a001b8d7943cb928",
                    "status": "affected",
                    "version": "f31ecf671ddc498f20219453395794ff2383e06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3e2205db2f0608898d535da1964e1b376aacfdaa",
                    "status": "affected",
                    "version": "f31ecf671ddc498f20219453395794ff2383e06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f8229d53d984c6a05b71ac9e9583d4354e3b91f",
                    "status": "affected",
                    "version": "f31ecf671ddc498f20219453395794ff2383e06b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "io_uring/waitid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: always prune wait queue entry in io_waitid_wait()\n\nFor a successful return, always remove our entry from the wait queue\nentry list. Previously this was skipped if a cancelation was in\nprogress, but this can race with another invocation of the wait queue\nentry callback."
          }
        ],
        "id": "CVE-2025-40047",
        "lastModified": "2026-07-30T06:24:08.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-28T12:15:38.793",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e2205db2f0608898d535da1964e1b376aacfdaa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/696ba6032081e617564a8113a001b8d7943cb928"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:13+00:00",
      "cve": "CVE-2025-40047",
      "id": "CVE-2025-40047",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:fixed": "1224",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40047.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:49:40Z",
      "cve": "CVE-2025-40047",
      "id": "CVE-2025-40047",
      "initial_release_date": "2025-10-29T00:25:19Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "490",
      "product_status:recommended": "336",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40047",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40047.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.