Skip to main content

Linux Kernel CVE-2025-40027

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Canonical
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell / unprivileged user namespace
  2. Delivery
    Mount crafted or invalid 9p share
  3. Exploit
    Version negotiation issues flush request
  4. Execution
    Race read-work cancel vs p9_fd_cancelled
  5. Persist
    Double list_del corrupts req_list
  6. Impact
    Kernel GPF/DoS, potential memory corruption

Vulnerability Assessment

Exploitation Conditions

Requires the 9p filesystem transport (net/9p trans_fd) to be present/loadable and the attacker to be able to initiate a 9p mount - either with mount capability (CAP_SYS_ADMIN, obtainable via an unprivileged user namespace) or by getting a victim to mount an attacker-controlled 9p server. The trigger is a flush request during protocol-version negotiation in p9_client_create() combined with concurrent connection cancellation in p9_read_work(). Limiting factors: exploitation is a timing-dependent race (non-deterministic window), it is local-only (AV:L), it needs the 9p modules loaded (not default on many hardened/minimal systems), and it needs at least low local privilege/namespace access (PR:L) - there is no remote or unauthenticated path.
Impact

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8) reflects local, low-privilege exploitation with high impact. However, signals conflict on real-world priority: this is a timing-dependent race condition, so reliable exploitation is materially harder than AC:L implies - I would assess AC:H. EPSS is low (0.22%, 12th percentile), there is no CISA KEV listing and no public PoC, and the finder is an automated fuzzing effort (Syzkaller/linuxtesting.org) rather than an active-threat report. The vulnerable 9p transport is not loaded or used in most production environments, further narrowing the realistic attack surface. The most probable outcome of successful triggering is a kernel crash (DoS); memory-corruption-to-privesc is theoretically possible but not demonstrated by any provided data. Net assessment: a legitimate memory-safety bug worth patching in the normal stable-kernel cadence, not an emergency. Note the vendor tag 'Information Disclosure' is not well supported by the description, which points to list corruption/DoS rather than a read primitive - treat that tag with caution.
Exploit ScenarioDerived

A local, low-privileged user (leveraging unprivileged user namespaces, or an attacker who controls a 9p server the target mounts) issues a mount of a crafted/invalid 9p filesystem, driving p9_client_create()'s version negotiation to send a flush request. By racing the connection's read-work cancellation against the flush cleanup, both paths call list_del() on the same request, corrupting kernel list pointers and crashing the machine (DoS), with potential for further memory corruption. No public exploit is identified; the condition was reproduced by Syzkaller, implying it is fuzzable but timing-sensitive.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).

RemediationAI

Upstream fix available (commit/backport; the primary change tightens the status check in p9_fd_cancelled() to process only requests still in REQ_STATUS_SENT). Apply the stable-kernel update from your distribution that incorporates the referenced commits (e.g. https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb and the other eight git.kernel.org stable links); a released patched tag is not independently confirmed from the provided data, so verify the fixed package version with your vendor (Canonical/Ubuntu tracking is indicated). As a compensating control until patched, prevent use of the vulnerable code path: do not mount 9p shares from untrusted sources, blacklist the 9pnet/9pnet_fd/9p modules where 9p is not required (modprobe blacklist, trade-off: breaks host/guest folder sharing in VMs and WSL2), and restrict unprivileged user-namespace mounting (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to remove low-privilege access to the mount path, at the cost of breaking rootless containers.

Affected ProductsAI

The Linux kernel's net/9p file-descriptor transport is affected. The nine git.kernel.org stable references (e.g. 5c64c0b7b3446f7ed088a13bc8d7487d66534cbb, 716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6, and seven others) indicate the fix was backported across multiple stable branches; the reproducer ran on 6.1.134-syzkaller. Exact fixed/unfixed version ranges are not enumerated in the provided data and should be confirmed against each distribution's kernel; the 'Canonical' tag suggests Ubuntu tracking. No CPE strings were supplied in the input, so precise affected-version boundaries could not be derived here. Vendor commits are available at https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb and the eight sibling links in the references.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the kernel's 9P2000 protocol client over a file-descriptor transport (trans_fd). 9p is commonly used to share filesystems between hosts and VMs/containers (QEMU/KVM, WSL2, virtfs). During mount, p9_client_create() negotiates the protocol version via p9_client_rpc(), which can issue a flush (p9_client_flush). The bug is a concurrency defect: the connection worker p9_read_work() calls p9_conn_cancel() which, under m->req_lock, rewrites the request status and performs list_del(&req->req_list); meanwhile p9_fd_cancelled() also performs list_del() on the same request. This is a race-condition-induced double free / list double-removal - root-cause classes CWE-362 (concurrent execution using shared resource without proper synchronization), CWE-415 (double free) and CWE-416 (use-after-free); the CVE record lists CWE as N/A. Commit 74d6a5d56629 previously fixed the REQ_STATUS_RCVD case; this fix broadens the guard in p9_fd_cancelled() so it skips any request whose status is not SENT, since whatever transitioned the state away from SENT already unlinked it.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local mount path so AV:L; timing-dependent race raises AC:H; low-priv/user-namespace mount access is PR:L; kernel memory corruption gives full C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/9p: fix double req put in p9_fd_cancelled

Syzkaller reports a KASAN issue as below:

general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734

Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

This happens because of a race condition between:

  • The 9p client sending an invalid flush request and later cleaning it up;
  • The 9p client in p9_read_work() canceled all pending requests.

Thread 1 Thread 2 ... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ...

spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ...

Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD.

Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

[updated the check from status RECV || status ERROR to status != SENT]

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in the Linux kernel's 9p filesystem support (CVE-2025-40027, CVSS 7.8) could allow local users to gain elevated privileges or disrupt services. Impact is concentrated in organizations using 9p-dependent infrastructure such as legacy Plan 9 systems or specific virtualization deployments. Although technically severe, real-world risk is significantly limited by the requirement for local access and very low exploitation likelihood (EPSS 0.2%, 12th percentile).

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigation: disable 9p filesystem support via kernel module blacklist or compile-time configuration where operationally feasible; restrict OS-level 9p mount permissions to administrative accounts; monitor Linux kernel security advisories and prepare upgrade procedures for when patches become available.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Medium
Linux ubiquitous, but 9p transport is niche-mainly VM/container filesystem sharing
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

References

Advisories & patches
ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4393/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4422/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4505/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4515/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4516/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4517/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20012/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20015/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20039/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20059/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20334/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20473/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20478/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20496/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20519/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20562/ REF https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4 REF https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06 REF https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 REF https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb REF https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7 REF https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 REF https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6 REF https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226 REF https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy