CVE-2025-40249 (GCVE-0-2025-40249)

Vulnerability from cvelistv5 – Published: 2025-12-04 16:08 – Updated: 2026-08-05 12:08
VLAI
Title
gpio: cdev: make sure the cdev fd is still active before emitting events
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 40b7c49950bd56c984b1f6722f865b922879260e , < dccc6daa8afa0f64c432e4c867f275747e3415e1 (git)
Affected: 40b7c49950bd56c984b1f6722f865b922879260e , < d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 (git)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.17.10 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dccc6daa8afa0f64c432e4c867f275747e3415e1",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            },
            {
              "lessThan": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
              "status": "affected",
              "version": "40b7c49950bd56c984b1f6722f865b922879260e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib-cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It\u0027s possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the GPIO character device `/dev/gpiochipN` via `open()`, `ioctl()` and `close()`, requiring local access to the system. There is no network-facing path to the GPIO line-state notifier chain.\nAC:L - The attacker controls both sides of the race \u2014 one thread loops open/`GPIO_V2_GET_LINEINFO_WATCH_IOCTL`/close while another loops line request/release/set-config to fire `gpiod_line_state_notify()` \u2014 and can retry indefinitely; the fput-to-release window can additionally be stretched to a full jiffy by forcing the `schedule_delayed_work(\u0026delayed_fput_work, 1)` path, and the reporter hit the condition during normal operation.\nPR:L - No capability check exists anywhere in `gpio_chrdev_open()` or `gpio_ioctl()` \u2014 only file permissions on `/dev/gpiochipN`, which embedded, IoT, automotive and Raspberry-Pi-class deployments routinely grant to a non-root `gpio` group or to unprivileged libgpiod control daemons. A basic unprivileged local account with that group membership is sufficient.\nUI:N - The attacker performs every step itself \u2014 opening the chardev, arming the line watch, generating the line-state change, and closing the fd. No victim action or cooperation is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on both the `struct file` and the ~9.4 KB `gpio_chardev_data` object; a resprayed `cdev` lets `kfifo_in_spinlocked()` and `fput(cdev-\u003efp)` read through attacker-chosen pointers, and `wake_up_poll()` on the freed wait queue yields a controlled call primitive, enabling arbitrary kernel memory disclosure.\nI:H - The queued work writes a 288-byte event record (with an attacker-supplied 32-byte consumer label) through the freed object\u0027s kfifo `data` pointer and performs a refcount decrement through a dangling `struct file *`, giving arbitrary-write and function-pointer-hijack primitives suitable for privilege escalation.\nA:H - In the common case the bug produces a `refcount_t` WARN (\"f_count incremented from zero; use-after-free condition present!\") \u2014 an immediate panic under `panic_on_warn` \u2014 followed by use-after-free accesses to a freed spinlock, kfifo and wait queue that reliably oops or panic the kernel, and the sequence is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:51.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64"
        }
      ],
      "title": "gpio: cdev: make sure the cdev fd is still active before emitting events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40249",
    "datePublished": "2025-12-04T16:08:12.206Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:51.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40249",
      "date": "2026-08-06",
      "epss": "0.00141",
      "percentile": "0.03895"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40249\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-04T16:16:18.380\",\"lastModified\":\"2026-07-30T06:24:22.030\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpio: cdev: make sure the cdev fd is still active before emitting events\\n\\nWith the final call to fput() on a file descriptor, the release action\\nmay be deferred and scheduled on a work queue. The reference count of\\nthat descriptor is still zero and it must not be used. It\u0027s possible\\nthat a GPIO change, we want to notify the user-space about, happens\\nAFTER the reference count on the file descriptor associated with the\\ncharacter device went down to zero but BEFORE the .release() callback\\nwas called from the workqueue and so BEFORE we unregistered from the\\nnotifier.\\n\\nUsing the regular get_file() routine in this situation triggers the\\nfollowing warning:\\n\\n  struct file::f_count incremented from zero; use-after-free condition present!\\n\\nSo use the get_file_active() variant that will return NULL on file\\ndescriptors that have been or are being released.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpio/gpiolib-cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"40b7c49950bd56c984b1f6722f865b922879260e\",\"lessThan\":\"dccc6daa8afa0f64c432e4c867f275747e3415e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40b7c49950bd56c984b1f6722f865b922879260e\",\"lessThan\":\"d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpio/gpiolib-cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.10\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:43:07+00:00",
      "cve": "CVE-2025-40249",
      "id": "CVE-2025-40249",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40249.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:02:30Z",
      "cve": "CVE-2025-40249",
      "id": "CVE-2025-40249",
      "initial_release_date": "2025-12-05T00:25:32Z",
      "product_status:known_not_affected": "408",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40249",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40249.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.