CVE-2025-40039

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.

Gravité et risque d'exploitation

CVE-2025-40039 obtient un score CVSS de 8.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.31 %, ce qui la place devant 22.7 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions <5cc679ba0f4505936124cd4179ba66bb0a4bd9f3, <=6.12.*, 6.12.53, 6.17.3, <69674b029002b1d90b655f014bdf64f404efa54d, 0, 6.6.123, <6b615a8fb3af0baf8126cde3d4fee97d57222ffc, <6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1, a4348710a7267705b75692dc1a000920481d1d92, <6.3, 6.18, 5.15.145, <=6.6.*, 6.3, 1f485b54d04a920723984062c912174330a05178, b685757c7b08d5073046fb379be965fd6c06aafc, <5.16, 052b41ef2abe274f068e892aee81406f11bd1f3a, <305853cce379407090a73b38c5de5ba748893aee, <=*, <=6.17.*) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d
• https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc
• https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3
• https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1
• https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee