Executive brief
A race condition vulnerability was identified in the Linux kernel's 9p network protocol implementation. This protocol is often used for communication between a host and virtual machines or containers. An exploit could allow a local attacker to trigger a system crash or potentially gain unauthorized access to sensitive system memory, impacting the overall stability and security of the host environment.
Technical details
A race condition exists in net/9p/trans_fd.c between p9_fd_cancelled() and p9_read_work(). The vulnerability is triggered when the 9p client sends an invalid flush request while p9_read_work() simultaneously cancels all pending requests. This leads to a double 'list_del' operation on the same request object because the status check in p9_fd_cancelled() was insufficiently restrictive, only checking for REQ_STATUS_RCVD. An attacker can exploit this to trigger a general protection fault or KASAN-detected wild memory access. The fix updates the status check to ensure that only requests still in the SENT state are processed for cancellation, as any other state implies the request has already been removed from the list.
Affected products
- Linux Linux Kernel afd8d6541155 to 674b56aa57f9
Timeline
- 2025-07-15: disclosed: Vulnerability reported by Linux Verification Center via Syzkaller.
- 2025-10-15: patched: Fix committed to Linux stable tree.
- 2025-10-28: advisory: CVE-2025-40027 published.
References
- https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4
- https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06
- https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036
- https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb
- https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7
- https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6
- https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6