GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40090 (GCVE-0-2025-40090)

Vulnerability from cvelistv5 – Published: 2025-10-30 09:47 – Updated: 2026-08-05 12:07
VLAI
Title
ksmbd: fix recursive locking in RPC handle list access
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool: $ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo <connection hung here> Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8) The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 69674b029002b1d90b655f014bdf64f404efa54d , < 5493571f4351f74e11db9943e98a07c56467cf7e (git)
Affected: 6b615a8fb3af0baf8126cde3d4fee97d57222ffc , < 1891abe832cbf5a11039e088766131d0f1642d02 (git)
Affected: 5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 , < 4602b8cee1481dbb896182e5cb1e8cf12910e9e7 (git)
Affected: 6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 , < 3412fbd81b46b9cfae013817b61d4bbd27e09e36 (git)
Affected: 305853cce379407090a73b38c5de5ba748893aee , < 88f170814fea74911ceab798a43cbd7c5599bed4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12.53 , < 6.12.55 (semver)
Affected: 6.17.3 , < 6.17.5 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5493571f4351f74e11db9943e98a07c56467cf7e",
              "status": "affected",
              "version": "69674b029002b1d90b655f014bdf64f404efa54d",
              "versionType": "git"
            },
            {
              "lessThan": "1891abe832cbf5a11039e088766131d0f1642d02",
              "status": "affected",
              "version": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
              "versionType": "git"
            },
            {
              "lessThan": "4602b8cee1481dbb896182e5cb1e8cf12910e9e7",
              "status": "affected",
              "version": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
              "versionType": "git"
            },
            {
              "lessThan": "3412fbd81b46b9cfae013817b61d4bbd27e09e36",
              "status": "affected",
              "version": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
              "versionType": "git"
            },
            {
              "lessThan": "88f170814fea74911ceab798a43cbd7c5599bed4",
              "status": "affected",
              "version": "305853cce379407090a73b38c5de5ba748893aee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.12.55",
              "status": "affected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17.5",
              "status": "affected",
              "version": "6.17.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.12.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.17.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix recursive locking in RPC handle list access\n\nSince commit 305853cce3794 (\"ksmbd: Fix race condition in RPC handle list\naccess\"), ksmbd_session_rpc_method() attempts to lock sess-\u003erpc_lock.\n\nThis causes hung connections / tasks when a client attempts to open\na named pipe. Using Samba\u0027s rpcclient tool:\n\n $ rpcclient //192.168.1.254 -U user%password\n $ rpcclient $\u003e srvinfo\n \u003cconnection hung here\u003e\n\nKernel side:\n  \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call trace:\n  __schedule from schedule+0x3c/0x58\n  schedule from schedule_preempt_disabled+0xc/0x10\n  schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8\n  rwsem_down_read_slowpath from down_read+0x28/0x30\n  down_read from ksmbd_session_rpc_method+0x18/0x3c\n  ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68\n  ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228\n  ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8\n  create_smb2_pipe from smb2_open+0x10c/0x27ac\n  smb2_open from handle_ksmbd_work+0x238/0x3dc\n  handle_ksmbd_work from process_scheduled_works+0x160/0x25c\n  process_scheduled_works from worker_thread+0x16c/0x1e8\n  worker_thread from kthread+0xa8/0xb8\n  kthread from ret_from_fork+0x14/0x38\n  Exception stack(0x8529ffb0 to 0x8529fff8)\n\nThe task deadlocks because the lock is already held:\n  ksmbd_session_rpc_open\n    down_write(\u0026sess-\u003erpc_lock)\n    ksmbd_rpc_open\n      ksmbd_session_rpc_method\n        down_read(\u0026sess-\u003erpc_lock)   \u003c-- deadlock\n\nAdjust ksmbd_session_rpc_method() callers to take the lock when necessary."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445, and the deadlock is triggered by a remote client sending an SMB2 CREATE for a named pipe on the IPC$ tree. No local access is needed.\nAC:L - This is an unconditional self-deadlock on a non-recursive rw_semaphore, hit deterministically on the very first named-pipe open \u2014 no race to win, no memory layout or timing dependency.\nPR:N - In the guest-mapping configuration common on ksmbd\u0027s NAS/embedded targets, ntlm_authenticate() skips NTLM password verification entirely for guest users, so an attacker with no credentials can establish a session, tree-connect to the always-present IPC$ share, and reach create_smb2_pipe().\nUI:N - The attacker triggers the deadlock purely by sending SMB2 protocol messages; no action by any local user or administrator is required.\nS:U - The deadlock affects kernel worker threads and ksmbd\u0027s own locks within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The thread blocks in down_read() before doing anything else; no memory is freed, over-read, or leaked, and no data is disclosed to the attacker.\nI:N - No memory corruption or data modification occurs \u2014 the only effect is a permanently held lock, which yields no write primitive.\nA:H - An unkillable D-state kworker holds sess-\u003erpc_lock forever, blocking connection teardown and \u2014 via ksmbd_sessions_deregister() holding the global sessions_table_lock \u2014 all sessions server-wide; destroy_workqueue() also hangs, so ksmbd cannot be restarted or unloaded and recovery requires a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:42.312Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02"
        },
        {
          "url": "https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36"
        },
        {
          "url": "https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4"
        }
      ],
      "title": "ksmbd: fix recursive locking in RPC handle list access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40090",
    "datePublished": "2025-10-30T09:47:58.611Z",
    "dateReserved": "2025-04-16T07:20:57.162Z",
    "dateUpdated": "2026-08-05T12:07:42.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40090",
      "date": "2026-09-19",
      "epss": "0.00261",
      "percentile": "0.18203"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/mgmt/user_session.c",
                  "fs/smb/server/smb2pdu.c",
                  "fs/smb/server/transport_ipc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5493571f4351f74e11db9943e98a07c56467cf7e",
                    "status": "affected",
                    "version": "69674b029002b1d90b655f014bdf64f404efa54d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1891abe832cbf5a11039e088766131d0f1642d02",
                    "status": "affected",
                    "version": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4602b8cee1481dbb896182e5cb1e8cf12910e9e7",
                    "status": "affected",
                    "version": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3412fbd81b46b9cfae013817b61d4bbd27e09e36",
                    "status": "affected",
                    "version": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88f170814fea74911ceab798a43cbd7c5599bed4",
                    "status": "affected",
                    "version": "305853cce379407090a73b38c5de5ba748893aee",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/mgmt/user_session.c",
                  "fs/smb/server/smb2pdu.c",
                  "fs/smb/server/transport_ipc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.12.55",
                    "status": "affected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.17.5",
                    "status": "affected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4EB1667-C055-4880-911F-BD74B6375984",
                    "versionEndExcluding": "6.12.55",
                    "versionStartIncluding": "6.12.53",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "99358CF3-A8B9-4638-A2ED-6200D3371019",
                    "versionEndExcluding": "6.17.5",
                    "versionStartIncluding": "6.17.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix recursive locking in RPC handle list access\n\nSince commit 305853cce3794 (\"ksmbd: Fix race condition in RPC handle list\naccess\"), ksmbd_session_rpc_method() attempts to lock sess-\u003erpc_lock.\n\nThis causes hung connections / tasks when a client attempts to open\na named pipe. Using Samba\u0027s rpcclient tool:\n\n $ rpcclient //192.168.1.254 -U user%password\n $ rpcclient $\u003e srvinfo\n \u003cconnection hung here\u003e\n\nKernel side:\n  \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call trace:\n  __schedule from schedule+0x3c/0x58\n  schedule from schedule_preempt_disabled+0xc/0x10\n  schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8\n  rwsem_down_read_slowpath from down_read+0x28/0x30\n  down_read from ksmbd_session_rpc_method+0x18/0x3c\n  ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68\n  ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228\n  ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8\n  create_smb2_pipe from smb2_open+0x10c/0x27ac\n  smb2_open from handle_ksmbd_work+0x238/0x3dc\n  handle_ksmbd_work from process_scheduled_works+0x160/0x25c\n  process_scheduled_works from worker_thread+0x16c/0x1e8\n  worker_thread from kthread+0xa8/0xb8\n  kthread from ret_from_fork+0x14/0x38\n  Exception stack(0x8529ffb0 to 0x8529fff8)\n\nThe task deadlocks because the lock is already held:\n  ksmbd_session_rpc_open\n    down_write(\u0026sess-\u003erpc_lock)\n    ksmbd_rpc_open\n      ksmbd_session_rpc_method\n        down_read(\u0026sess-\u003erpc_lock)   \u003c-- deadlock\n\nAdjust ksmbd_session_rpc_method() callers to take the lock when necessary."
          }
        ],
        "id": "CVE-2025-40090",
        "lastModified": "2026-07-30T06:24:10.810",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-30T10:15:33.537",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:17:54+00:00",
      "cve": "CVE-2025-40090",
      "id": "CVE-2025-40090",
      "initial_release_date": "2025-10-30T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix recursive locking in RPC handle list access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40090.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:49:16Z",
      "cve": "CVE-2025-40090",
      "id": "CVE-2025-40090",
      "initial_release_date": "2025-10-31T00:25:16Z",
      "product_status:known_not_affected": "514",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40090",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40090.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.