CVE-2025-40027
Description
In the Linux kernel, the following vulnerability has been resolved:
net/9p: fix double req put in p9_fd_cancelled
Syzkaller reports a KASAN issue as below:
general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734
Call Trace:
p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
This happens because of a race condition between:
- The 9p client sending an invalid flush request and later cleaning it up;
- The 9p client in p9_read_work() canceled all pending requests.
Thread 1 Thread 2 ... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ...
spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ...
Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD.
Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
[updated the check from status == RECV || status == ERROR to status != SENT]
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A double-free race condition in the Linux kernel's 9P net/trans_fd.c can cause a general protection fault, leading to a denial of service.
Vulnerability
CVE-2025-40027 is a double-free vulnerability in the Linux kernel's 9P (Plan 9) network filesystem transport layer, specifically in the p9_fd_cancelled function within net/9p/trans_fd.c. The root cause is a race condition between two threads: one thread sends an invalid flush request and later cleans it up, while another thread in p9_read_work() cancels all pending requests. This race leads to a double put (reference count decrement) on a request structure, resulting in a use-after-free or general protection fault as reported by syzkaller [1].
Exploitation
The vulnerability is triggered during normal 9P client operations, such as mounting a 9P filesystem via v9fs_mount(). The attack surface is local, requiring the ability to mount a 9P filesystem or interact with the 9P client. No special privileges are needed beyond those required to mount a filesystem, but the attacker must be able to trigger the race condition, which may involve sending crafted flush requests. The race occurs between the client's flush handling and the read work queue processing [1].
Impact
Successful exploitation results in a kernel crash (general protection fault) due to memory corruption, leading to a denial of service (DoS) for the affected system. The KASAN report indicates a wild memory access, confirming memory corruption. There is no evidence of privilege escalation or remote code execution from the provided description [1].
Mitigation
The vulnerability is fixed in the Linux kernel by commit 716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 (and backports to stable kernels). Users should apply the latest kernel updates from their distribution. No workaround is mentioned; the fix ensures proper synchronization in p9_fd_cancelled to prevent the double put [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
9716dceb19a9f448db01a48e194797b84cb99674b56aa57f9a5901a0dfb595c64c0b7b344c1db864270eb0e0097005abc284e67a93b8cVulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
9- git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4nvd
- git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06nvd
- git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036nvd
- git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbbnvd
- git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7nvd
- git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6nvd
- git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6nvd
- git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226nvd
- git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8nvd
News mentions
0No linked articles in our index yet.