CVE-2025-40039 ksmbd: Fix race condition in RPC handle list access
A race condition in the Linux kernel's ksmbd module allows attackers to cause data corruption or use-after-free, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40039?
CVE-2025-40039 is a high-severity vulnerability in Linux kernel, published on 28 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Fix race condition in RPC handle list access
The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions.
In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications.
Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced.
Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.
Weakness: CWE-362
Which versions are affected by CVE-2025-40039?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-40039?
Apply the vendor's patch.
Is CVE-2025-40039 being exploited?
There is no known exploitation of CVE-2025-40039 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-78383, BELL-CVE-2025-40039, DEBIAN-CVE-2025-40039, GHSA-258w-3pq9-4jh3, ROOT-OS-DEBIAN-12-CVE-2025-40039, ROOT-OS-DEBIAN-13-CVE-2025-40039 and 3 more.