CVE-2025-40249 (GCVE-0-2025-40249)
Vulnerability from cvelistv5
Published
2025-12-04 16:08
Modified
2026-08-05 12:08
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.
References
Impacted products
Vendor Product Version
Linux Linux Version: 40b7c49950bd56c984b1f6722f865b922879260e
Version: 40b7c49950bd56c984b1f6722f865b922879260e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dccc6daa8afa0f64c432e4c867f275747e3415e1",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            },
            {
              "lessThan": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It\u0027s possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the GPIO character device `/dev/gpiochipN` via `open()`, `ioctl()` and `close()`, requiring local access to the system. There is no network-facing path to the GPIO line-state notifier chain.\nAC:L - The attacker controls both sides of the race \u2014 one thread loops open/`GPIO_V2_GET_LINEINFO_WATCH_IOCTL`/close while another loops line request/release/set-config to fire `gpiod_line_state_notify()` \u2014 and can retry indefinitely; the fput-to-release window can additionally be stretched to a full jiffy by forcing the `schedule_delayed_work(\u0026delayed_fput_work, 1)` path, and the reporter hit the condition during normal operation.\nPR:L - No capability check exists anywhere in `gpio_chrdev_open()` or `gpio_ioctl()` \u2014 only file permissions on `/dev/gpiochipN`, which embedded, IoT, automotive and Raspberry-Pi-class deployments routinely grant to a non-root `gpio` group or to unprivileged libgpiod control daemons. A basic unprivileged local account with that group membership is sufficient.\nUI:N - The attacker performs every step itself \u2014 opening the chardev, arming the line watch, generating the line-state change, and closing the fd. No victim action or cooperation is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on both the `struct file` and the ~9.4 KB `gpio_chardev_data` object; a resprayed `cdev` lets `kfifo_in_spinlocked()` and `fput(cdev-\u003efp)` read through attacker-chosen pointers, and `wake_up_poll()` on the freed wait queue yields a controlled call primitive, enabling arbitrary kernel memory disclosure.\nI:H - The queued work writes a 288-byte event record (with an attacker-supplied 32-byte consumer label) through the freed object\u0027s kfifo `data` pointer and performs a refcount decrement through a dangling `struct file *`, giving arbitrary-write and function-pointer-hijack primitives suitable for privilege escalation.\nA:H - In the common case the bug produces a `refcount_t` WARN (\"f_count incremented from zero; use-after-free condition present!\") \u2014 an immediate panic under `panic_on_warn` \u2014 followed by use-after-free accesses to a freed spinlock, kfifo and wait queue that reliably oops or panic the kernel, and the sequence is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:51.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64"
        }
      ],
      "title": "gpio: cdev: make sure the cdev fd is still active before emitting events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40249",
    "datePublished": "2025-12-04T16:08:12.206Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:51.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.