{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40249","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.181Z","datePublished":"2025-12-04T16:08:12.206Z","dateUpdated":"2026-08-05T12:08:51.621Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:08:51.621Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: make sure the cdev fd is still active before emitting events\n\nWith the final call to fput() on a file descriptor, the release action\nmay be deferred and scheduled on a work queue. The reference count of\nthat descriptor is still zero and it must not be used. It's possible\nthat a GPIO change, we want to notify the user-space about, happens\nAFTER the reference count on the file descriptor associated with the\ncharacter device went down to zero but BEFORE the .release() callback\nwas called from the workqueue and so BEFORE we unregistered from the\nnotifier.\n\nUsing the regular get_file() routine in this situation triggers the\nfollowing warning:\n\n  struct file::f_count incremented from zero; use-after-free condition present!\n\nSo use the get_file_active() variant that will return NULL on file\ndescriptors that have been or are being released."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through the GPIO character device `/dev/gpiochipN` via `open()`, `ioctl()` and `close()`, requiring local access to the system. There is no network-facing path to the GPIO line-state notifier chain.\nAC:L - The attacker controls both sides of the race — one thread loops open/`GPIO_V2_GET_LINEINFO_WATCH_IOCTL`/close while another loops line request/release/set-config to fire `gpiod_line_state_notify()` — and can retry indefinitely; the fput-to-release window can additionally be stretched to a full jiffy by forcing the `schedule_delayed_work(&delayed_fput_work, 1)` path, and the reporter hit the condition during normal operation.\nPR:L - No capability check exists anywhere in `gpio_chrdev_open()` or `gpio_ioctl()` — only file permissions on `/dev/gpiochipN`, which embedded, IoT, automotive and Raspberry-Pi-class deployments routinely grant to a non-root `gpio` group or to unprivileged libgpiod control daemons. A basic unprivileged local account with that group membership is sufficient.\nUI:N - The attacker performs every step itself — opening the chardev, arming the line watch, generating the line-state change, and closing the fd. No victim action or cooperation is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on both the `struct file` and the ~9.4 KB `gpio_chardev_data` object; a resprayed `cdev` lets `kfifo_in_spinlocked()` and `fput(cdev->fp)` read through attacker-chosen pointers, and `wake_up_poll()` on the freed wait queue yields a controlled call primitive, enabling arbitrary kernel memory disclosure.\nI:H - The queued work writes a 288-byte event record (with an attacker-supplied 32-byte consumer label) through the freed object's kfifo `data` pointer and performs a refcount decrement through a dangling `struct file *`, giving arbitrary-write and function-pointer-hijack primitives suitable for privilege escalation.\nA:H - In the common case the bug produces a `refcount_t` WARN (\"f_count incremented from zero; use-after-free condition present!\") — an immediate panic under `panic_on_warn` — followed by use-after-free accesses to a freed spinlock, kfifo and wait queue that reliably oops or panic the kernel, and the sequence is repeatable at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpiolib-cdev.c"],"versions":[{"version":"40b7c49950bd56c984b1f6722f865b922879260e","lessThan":"dccc6daa8afa0f64c432e4c867f275747e3415e1","status":"affected","versionType":"git"},{"version":"40b7c49950bd56c984b1f6722f865b922879260e","lessThan":"d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpio/gpiolib-cdev.c"],"versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","status":"unaffected","versionType":"semver"},{"version":"6.17.10","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.17.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dccc6daa8afa0f64c432e4c867f275747e3415e1"},{"url":"https://git.kernel.org/stable/c/d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64"}],"title":"gpio: cdev: make sure the cdev fd is still active before emitting events","x_generator":{"engine":"bippy-1.2.0"}}}}