CVE-2025-40305 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
A flaw in the Linux kernel 9p filesystem transport can cause a denial of service by failing to wake up the read thread when the pipe is full.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40305?
CVE-2025-40305 is a denial of service vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) if list_empty(&m->req_list).
However, if the pipe is full, we need to read more data and this used to work prior to commit aaec5a95d59615 ("pipe_read: don't wake up the writer if the pipe is still full").
p9_read_work() does p9_fd_read() -> ... -> anon_pipe_read() which (before the commit above) triggered the unnecessary wakeup. This wakeup calls p9_pollwake() which kicks p9_poll_workfn() -> p9_poll_mux(), p9_poll_mux() will notice EPOLLIN and schedule_work(&m->rq).
This no longer happens after the optimization above, change p9_fd_request() to use p9_poll_mux() instead of only checking for EPOLLOUT.
Which versions are affected by CVE-2025-40305?
How do I fix CVE-2025-40305?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40305 being exploited?
There is no known exploitation of CVE-2025-40305 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40305, DEBIAN-CVE-2025-40305, GHSA-jr46-vc8c-pm2x, ROOT-OS-DEBIAN-12-CVE-2025-40305, ROOT-OS-DEBIAN-13-CVE-2025-40305, ROOT-OS-UBUNTU-2204-CVE-2025-40305 and 2 more.