CVE-2025-40027

一、漏洞信息
 漏洞编号：[CVE-2025-40027](https://nvd.nist.gov/vuln/detail/CVE-2025-40027)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/9p: fix double req put in p9_fd_cancelledSyzkaller reports a KASAN issue as below:general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTIKASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014RIP: 0010:__list_del include/linux/list.h:114 [inline]RIP: 0010:__list_del_entry include/linux/list.h:137 [inline]RIP: 0010:list_del include/linux/list.h:148 [inline]RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8This happens because of a race condition between:- The 9p client sending an invalid flush request and later cleaning it up;- The 9p client in p9_read_work() canceled all pending requests.      Thread 1                              Thread 2    ...    p9_client_create()    ...    p9_fd_create()    ...    p9_conn_create()    ...    // start Thread 2    INIT_WORK(&m->rq, p9_read_work);                                        p9_read_work()    ...    p9_client_rpc()    ...                                        ...                                        p9_conn_cancel()                                        ...                                        spin_lock(&m->req_lock);    ...    p9_fd_cancelled()    ...                                        ...                                        spin_unlock(&m->req_lock);                                        // status rewrite                                        p9_client_cb(m->client, req, REQ_STATUS_ERROR)                                        // first remove                                        list_del(&req->req_list);                                        ...    spin_lock(&m->req_lock)    ...    // second remove    list_del(&req->req_list);    spin_unlock(&m->req_lock)  ...Commit 74d6a5d56629 ( 9p/trans_fd: Fix concurrency del of req_list inp9_fd_cancelled/p9_read_work ) fixes a concurrency issue in the 9p filesystemclient where the req_list could be deleted simultaneously by bothp9_read_work and p9_fd_cancelled functions, but for the case where req->statusequals REQ_STATUS_RCVD.Update the check for req->status in p9_fd_cancelled to skip processing notjust received requests, but anything that is not SENT, as whateverchanged the state from SENT also removed the request from its list.Found by Linux Verification Center (linuxtesting.org) with Syzkaller.[updated the check from status == RECV || status == ERROR to status != SENT]
 漏洞公开时间：2025-10-28 18:15:42
 漏洞创建时间：2025-10-28 18:11:37
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-40027
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40027-8088@gregkh/T |  |
|  | https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 |  |
|  | https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-40027 |  |
|  | https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8 |  |
|  | https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-40027 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40027 |  |
|  | https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4 |  |
|  | https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2406713 |  |
|  | https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6 |  |
|  | https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06 |  |
|  | https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7 |  | ljqc |
|  |  | https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb |  | cvelistv5 |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                      
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/kernel

内容风险标识

评论 (3)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-40027

评论 (3)

搜索帮助

src-openEuler/kernel