{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-quadspi: Implement refcount to handle unbind during busy\n\ndriver support indirect read and indirect write operation with\nassumption no force device removal(unbind) operation. However\nforce device removal(removal) is still available to root superuser.\n\nUnbinding driver during operation causes kernel crash. This changes\nensure driver able to handle such operation for indirect read and\nindirect write by implementing refcount to track attached devices\nto the controller and gracefully wait and until attached devices\nremove operation completed before proceed with removal operation."
    }
  ],
  "id": "CVE-2025-40005",
  "lastModified": "2025-10-21T19:31:25.450",
  "metrics": {},
  "published": "2025-10-20T16:15:37.127",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7446284023e8ef694fb392348185349c773eefb3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b7ec8a2b094a33d0464958c2cbf75b8f229098b0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "azl3 kernel 6.6.96.2-2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 kernel 6.6.104.2-4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-40016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40016"
    },
    {
      "name": "CVE-2025-40005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40005"
    },
    {
      "name": "CVE-2025-40001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40001"
    },
    {
      "name": "CVE-2025-40003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40003"
    }
  ],
  "initial_release_date": "2025-10-23T00:00:00",
  "last_revision_date": "2025-10-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0915",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": "2025-10-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40003",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40003"
    },
    {
      "published_at": "2025-10-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40001",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40001"
    },
    {
      "published_at": "2025-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40005",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40005"
    },
    {
      "published_at": "2025-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-40016",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40016"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-40005"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-20T16:15:37Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-quadspi: Implement refcount to handle unbind during busy\n\ndriver support indirect read and indirect write operation with\nassumption no force device removal(unbind) operation. However\nforce device removal(removal) is still available to root superuser.\n\nUnbinding driver during operation causes kernel crash. This changes\nensure driver able to handle such operation for indirect read and\nindirect write by implementing refcount to track attached devices\nto the controller and gracefully wait and until attached devices\nremove operation completed before proceed with removal operation.",
  "id": "GHSA-g4vw-3hq5-q7gr",
  "modified": "2025-10-20T18:30:32Z",
  "published": "2025-10-20T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40005"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7446284023e8ef694fb392348185349c773eefb3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7ec8a2b094a33d0464958c2cbf75b8f229098b0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40005.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "spi: cadence-quadspi: Implement refcount to handle unbind during busy",
    "tracking": {
      "current_release_date": "2025-10-22T01:01:31.000Z",
      "generator": {
        "date": "2025-10-22T22:49:11.235Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-40005",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-10-22T01:01:31.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 6.6.96.2-2",
                "product": {
                  "name": "azl3 kernel 6.6.96.2-2",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 6.6.104.2-4",
                "product": {
                  "name": "azl3 kernel 6.6.104.2-4",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 6.6.96.2-2 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 6.6.104.2-4 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-40005",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-40005 spi: cadence-quadspi: Implement refcount to handle unbind during busy - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40005.json"
        }
      ],
      "title": "spi: cadence-quadspi: Implement refcount to handle unbind during busy"
    }
  ]
}