Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) can cause the system to stop responding when processing certain network requests. ksmbd is a component that allows the Linux kernel to share files and services over a network using the SMB protocol. An attacker or a malfunctioning client can trigger a 'deadlock'—a state where the system is stuck waiting for itself—leading to a complete loss of availability for the file sharing service.
Technical details
A deadlock vulnerability exists in the ksmbd component of the Linux kernel due to improper lock management in RPC handle list access. Specifically, ksmbd_session_rpc_method() attempts to acquire sess->rpc_lock while it is already held by a caller, such as ksmbd_session_rpc_open(). This recursive locking occurs when a client attempts to open a named pipe, causing the kworker thread to hang indefinitely. The issue was introduced in a previous fix for a race condition (commit 305853cce3794). The vulnerability can be triggered remotely via network requests that initiate RPC operations. Patches have been released for various stable kernel branches to adjust locking logic.
Affected products
- Linux Linux Kernel 6.12.53 to 6.12.55, 6.17.3 to 6.17.5, 6.18-rc1
Timeline
- 2025-10-30: advisory: CVE-2025-40090 published
- 2025-10-23: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02
- https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36
- https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7
- https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e
- https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4