Executive brief
A vulnerability in the Linux kernel's GPIO (General Purpose Input/Output) subsystem could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue occurs when the system tries to process hardware notifications for a device that is in the process of being closed. This race condition can lead to a 'use-after-free' error, which compromises the stability and security of the operating system.
Technical details
A use-after-free vulnerability exists in the Linux kernel's `drivers/gpio/gpiolib-cdev.c` component. The root cause is a race condition where a GPIO line state change notification occurs after a file descriptor's reference count has reached zero but before the `.release()` callback has finished unregistering the notifier. In this window, the code previously used `get_file()`, which increments a zeroed reference count and triggers a kernel warning/panic. An attacker with local access could potentially exploit this race condition to cause a denial of service or achieve privilege escalation. The fix replaces `get_file()` with `get_file_active()`, which correctly identifies and ignores file descriptors that are already in the process of being released.
Affected products
- Linux Linux Kernel 6.13, 6.17.10
Timeline
- 2025-11-17: patched: Initial fix commit authored by Bartosz Golaszewski
- 2025-12-04: disclosed: CVE-2025-40249 published