CVE-2025-40130 scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
A data race in the Linux kernel's UFS driver can lead to memory corruption, allowing local attackers to cause denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40130?
CVE-2025-40130 is a vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
The cpu_latency_qos_add/remove/update_request interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current implementation relies on the 'pm_qos_enabled' flag, which is insufficient to prevent concurrent access and cannot serve as a proper synchronization mechanism. This has led to data races and list corruption issues.
A typical race condition call trace is:
[Thread A] ufshcd_pm_qos_exit() --> cpu_latency_qos_remove_request() --> cpu_latency_qos_apply(); --> pm_qos_update_target() --> plist_del <--(1) delete plist node --> memset(req, 0, sizeof(*req)); --> hba->pm_qos_enabled = false;
[Thread B] ufshcd_devfreq_target --> ufshcd_devfreq_scale --> ufshcd_scale_clks --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true --> cpu_latency_qos_update_request --> pm_qos_update_target --> plist_del <--(3) plist node use-after-free
Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe access to PM QoS resources, including sysfs interface reads.
Which versions are affected by CVE-2025-40130?
Linux distribution packages (9)
kernel-livepatch-SLE16_Update_1 SUSE:Linux Enterprise Server 16.0 | All versions | 5-160000.1.1 |
kernel-livepatch-SLE16_Update_2 SUSE:Linux Enterprise Server 16.0 | All versions | 3-160000.1.1 |
kernel-livepatch-SLE16_Update_3 SUSE:Linux Enterprise Server 16.0 | All versions | 2-160000.1.1 |
kernel-livepatch-SLE16_Update_1 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 5-160000.1.1 |
kernel-livepatch-SLE16_Update_2 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3-160000.1.1 |
kernel-livepatch-SLE16_Update_3 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2-160000.1.1 |
kernel-livepatch-SLE16_Update_1 SUSE:Linux Micro 6.2 | All versions | 5-160000.1.1 |
kernel-livepatch-SLE16_Update_2 SUSE:Linux Micro 6.2 | All versions | 3-160000.1.1 |
kernel-livepatch-SLE16_Update_3 SUSE:Linux Micro 6.2 | All versions | 2-160000.1.1 |
How do I fix CVE-2025-40130?
Apply the vendor's patch.
Is CVE-2025-40130 being exploited?
There is no known exploitation of CVE-2025-40130 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40130, DEBIAN-CVE-2025-40130, GHSA-95p9-9rrc-wpx4, ROOT-OS-DEBIAN-13-CVE-2025-40130, SUSE-SU-2026:20634-1, SUSE-SU-2026:20636-1 and 5 more.