CVE-2025-40146

The vulnerability is a potential deadlock in the Linux kernel's block multi-queue (blk-mq) subsystem. The issue occurs when the nr_requests parameter is grown while the queue is frozen. The original code allocated and freed sched_tags during the frozen state, which could lead to a deadlock due to the locking order.

Exploitation of this deadlock requires the ability to trigger a resize of nr_requests on a blk-mq queue. This action is performed by writing to a sysfs file, which typically requires root privileges. The deadlock condition manifests when the queue is already frozen for another operation.

An attacker with local root access could cause a denial of service by inducing a deadlock that hangs the kernel, affecting all block devices using the multi-queue interface. The fix ensures that memory allocation happens before freezing the queue and freeing memory after unfreezing.

The vulnerability is addressed in the Linux kernel stable commit referenced [1]. Users should apply the kernel patch to prevent the deadlock.