CVE-2025-40130

Vulnerability

Description

The Linux kernel's UFS (Universal Flash Storage) core driver contains a data race vulnerability in its CPU latency PM QoS request handling. The cpu_latency_qos_add/remove/update_request interfaces are intentionally unsynchronized, requiring callers to manage thread safety. However, the UFS driver relied solely on a pm_qos_enabled flag, which is insufficient to prevent concurrent access to PM QoS resources [1]. This leads to situations where one thread may remove and zero out a request structure while another thread attempts to update it, causing list corruption and use-after-free [1].

Exploitation

Scenario

An attacker would need to trigger a race condition between two kernel threads: one calling ufshcd_pm_qos_exit() (which removes a PM QoS request and sets pm_qos_enabled = false), and another calling ufshcd_devfreq_target → ufshcd_pm_qos_update (which checks pm_qos_enabled and then attempts to update the request) [1]. The window is small, but successful exploitation could allow the attacker to corrupt kernel memory. No special privileges beyond basic system access are required, as the driver is accessible when the UFS device is in use.

Impact

A successful data race can cause a use-after-free or double-free condition in the plist node used for PM QoS management. This may lead to system crashes (denial of service) or, in more severe cases, memory corruption that could be leveraged for privilege escalation [1]. The integrity of the kernel's PM QoS subsystem is compromised, potentially affecting device power management and performance.

Mitigation

The fix introduces a dedicated mutex to serialize all PM QoS operations in the UFS driver, preventing concurrent accesses [1]. This patch has been applied to the Linux kernel stable tree. Users should update to a kernel version that includes commit d9df61afb8d23c475f1be3c714da2c34c156ab01. No workarounds are available for unpatched kernels.