Skip to main content

Linux Kernel ksmbd CVE-2025-40090

MEDIUM
Uncontrolled Recursion (CWE-674)
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Attack originates from a network SMB client per the description, making AV:N accurate; PR:L reflects required SMB credentials; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:43 vuln.today
CVE Published
Oct 30, 2025 - 10:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix recursive locking in RPC handle list access

Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.

This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool:

$ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo <connection hung here>

Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8)

The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock

Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.

AnalysisAI

Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.

Technical ContextAI

ksmbd (CONFIG_SMB_SERVER) is the Linux kernel's native SMB server, introduced in kernel 5.15 as an alternative to userspace Samba. The affected component is the RPC handle list, which tracks named pipe sessions per ksmbd_session struct. The sess->rpc_lock field is a Linux rwsem (read-write semaphore), which does not support recursive acquisition - attempting a down_read() while the same thread holds down_write() on the same semaphore causes the thread to block on rwsem_down_read_slowpath indefinitely. CWE-674 (Uncontrolled Recursion/Improper Control Flow Management) captures this root cause: the lock acquisition hierarchy was broken when the race-condition fix in commit 305853cce3794 added a lock call inside ksmbd_session_rpc_method() without accounting for callers that already held the lock. The CPE data (cpe:2.3:o:linux:linux_kernel:*) covers all kernel versions through 6.18-rc1 that include ksmbd. The call chain - smb2_open → create_smb2_pipe → ksmbd_session_rpc_open (down_write) → ksmbd_rpc_open → ksmbd_session_rpc_method (down_read) - is triggered by any SMB2 named pipe open operation against IPC$.

RemediationAI

Apply the upstream stable-tree patches available at https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02, https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36, https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7, https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e, and https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4; update to a kernel release incorporating these commits once available from your distribution. As an immediate compensating control, disable ksmbd by stopping the service and unloading the ksmbd kernel module ('rmmod ksmbd') if SMB server functionality is not required - this eliminates the attack surface entirely with no side effects for non-SMB workloads. If ksmbd must remain active, restrict TCP 445 access via firewall rules to only trusted host ranges to prevent unauthenticated network actors from establishing sessions, reducing exposure to already-authorized internal users only. Note that firewall restriction does not prevent exploitation by any user already authorized to access the SMB share.

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40090 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy