CVE-2025-40039: ksmbd: Fix race condition in RPC handle list access

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-28 · updated 2026-10-19
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.

Affected products

Linux kernel: from 5.15.145 before 5.16; from 6.1.71 before 6.2; from 6.3 before 6.6.123; from 6.7 before 6.12.53; from 6.13 before 6.17.3 — fixed in 5.16, 6.12.53, 6.17.3, 6.2, 6.6.123

How to fix

Upgrade to a fixed version: Linux kernel 5.16, 6.12.53, 6.17.3, 6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40039 or the next vulnerability affects your stack