Junglewise Threat Intelligence

CVE-2025-40271: Linux Kernel use-after-free in proc_readdir_de

CVE-2025-40271 · Severity: info · CVSS 5.5 · Published 2025-12-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's handling of the /proc file system, which provides information about processes and system hardware. Under specific conditions involving high system stress and network device reconfiguration, the kernel could attempt to access memory that has already been freed. This could lead to system instability, crashes, or potentially allow an attacker to disrupt system operations.

Technical details

A use-after-free (UAF) vulnerability exists in fs/proc/generic.c within the proc_readdir_de() function. The issue stems from the fact that when a Proc Directory Entry (PDE) is removed from the subdirectory red-black tree using rb_erase(), the node is not explicitly cleared. During a race condition—specifically when one thread is traversing a directory (e.g., via getdents) while another thread is unregistering network devices—pde_subdir_next() may return a pointer to a PDE that has already been released to the slab allocator. This occurs because the traversal logic relies on the state of the erased node to determine the next entry. The fix involves using RB_CLEAR_NODE() after rb_erase() to ensure subsequent lookups correctly return NULL instead of a stale pointer.

Affected products

  • Linux Linux Kernel Fixed in various stable branches including 6.1, 6.6, 6.11, 6.12, and 6.13-rc1

Timeline

  • 2025-10-25: other: Initial patch submitted by Wei Yang
  • 2025-11-24: patched: Patch committed to stable trees
  • 2025-12-06: advisory: CVE-2025-40271 published

References

Related threats