CVE-2025-40249

Root

Cause

In the Linux kernel's GPIO character device (gpio-cdev), the final fput() on a file descriptor may defer the release action to a work queue. Between the time the reference count drops to zero and the .release() callback is invoked (which unregisters from the notifier), a GPIO change notification could attempt to use the file descriptor. Using get_file() on a zero-refcount file triggers a kernel warning about a use-after-free condition [1].

Exploitation

An attacker would need to open a GPIO line handle via /dev/gpiochipN and trigger a GPIO state change after closing the file descriptor but before the deferred release completes. The race window exists during the asynchronous cleanup of the character device file. No special privileges beyond access to the GPIO character device are required; however, physical or logical access to trigger GPIO changes is necessary [1].

Impact

Successful exploitation could lead to a use-after-free condition on the file structure, potentially resulting in memory corruption, denial of service (system crash), or in specific configurations, privilege escalation. The kernel's warning indicates memory corruption is possible [1].

Mitigation

The fix was committed to the Linux kernel stable tree (commit d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64) and uses get_file_active() instead of get_file(), which returns NULL if the file descriptor is already being released, thereby preventing the unsafe operation [1]. Users should update to a kernel version containing this commit.