ghsa-m33j-r627-qphr
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix recursive locking in RPC handle list access
Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool:
$ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo
Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8)
The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock
Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
{
"affected": [],
"aliases": [
"CVE-2025-40090"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T10:15:33Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix recursive locking in RPC handle list access\n\nSince commit 305853cce3794 (\"ksmbd: Fix race condition in RPC handle list\naccess\"), ksmbd_session_rpc_method() attempts to lock sess-\u003erpc_lock.\n\nThis causes hung connections / tasks when a client attempts to open\na named pipe. Using Samba\u0027s rpcclient tool:\n\n $ rpcclient //192.168.1.254 -U user%password\n $ rpcclient $\u003e srvinfo\n \u003cconnection hung here\u003e\n\nKernel side:\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000\n Workqueue: ksmbd-io handle_ksmbd_work\n Call trace:\n __schedule from schedule+0x3c/0x58\n schedule from schedule_preempt_disabled+0xc/0x10\n schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8\n rwsem_down_read_slowpath from down_read+0x28/0x30\n down_read from ksmbd_session_rpc_method+0x18/0x3c\n ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68\n ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228\n ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8\n create_smb2_pipe from smb2_open+0x10c/0x27ac\n smb2_open from handle_ksmbd_work+0x238/0x3dc\n handle_ksmbd_work from process_scheduled_works+0x160/0x25c\n process_scheduled_works from worker_thread+0x16c/0x1e8\n worker_thread from kthread+0xa8/0xb8\n kthread from ret_from_fork+0x14/0x38\n Exception stack(0x8529ffb0 to 0x8529fff8)\n\nThe task deadlocks because the lock is already held:\n ksmbd_session_rpc_open\n down_write(\u0026sess-\u003erpc_lock)\n ksmbd_rpc_open\n ksmbd_session_rpc_method\n down_read(\u0026sess-\u003erpc_lock) \u003c-- deadlock\n\nAdjust ksmbd_session_rpc_method() callers to take the lock when necessary.",
"id": "GHSA-m33j-r627-qphr",
"modified": "2025-10-30T12:31:09Z",
"published": "2025-10-30T12:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40090"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.