CVE-2025-40105

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40105", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.165Z", "datePublished": "2025-10-30T09:48:09.674Z", "dateUpdated": "2026-11-10T12:37:36.894Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:50.794Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don't leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn't point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\"VFS: don't keep disconnected dentries on d_anon\")\nwhich removed adding of most disconnected dentries to sb->s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn't marked as disconnected, as in the\nscenario described above, the reclaim doesn't happen and the dentries\nare \"leaked\". Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \"Busy\ninodes after unmount\" bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered through the `open_by_handle_at()` syscall (and the attacker must also drive the `umount` that converts the dentry leak into the busy-inode/superblock use-after-free), both of which require local system access. The nfsd file-handle path reaches the same code remotely but only produces the reclaimable leak, since a remote client cannot trigger the unmount.\nAC:L - With a malicious FUSE server (or a crafted/corrupt filesystem image, as in the syzbot reproducer) the attacker fully controls `get_parent()`, the readdir entry name, and the `lookup()` result, so the `tmp != dentry` mismatch in `reconnect_one()` is produced deterministically with no race to win. Even the alternate rename-race variant is driven by both sides under attacker control.\nPR:L - `may_decode_fh()` accepts `ns_capable(s_user_ns, CAP_SYS_ADMIN)` for `O_DIRECTORY` handles since v6.11, and FUSE is `FS_USERNS_MOUNT` with export ops enabled by a server-supplied flag, so an ordinary unprivileged user can satisfy every gate inside their own user namespace on their own mount. No real root in the initial namespace is needed.\nUI:N - The attacker performs the mount, the `open_by_handle_at()` call, and the unmount entirely themselves within their own user/mount namespace. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed. This is standard in-kernel impact.\nC:H - The leaked dentries survive `generic_shutdown_super()` with `d_sb` pointing at a freed `super_block`, and the poisoned inodes remain on a torn-down superblock \u2014 a use-after-free that lets an attacker who sprays the freed slab read back kernel memory through subsequent dcache walks. Per UAF scoring this is High.\nI:H - The dangling `d_sb`/`d_op` and `list_lru_destroy()`d LRU heads mean later `__dentry_kill()`/`iput_final()` operate on reallocated memory, including indirect calls through `d_op->d_release`/`s_op` in a possibly unloaded module \u2014 a controllable write/control-flow primitive. Use-after-free is scored High for integrity.\nA:H - Unmount reliably produces the `VFS: Busy inodes after unmount` `CHECK_DATA_CORRUPTION` WARN \u2014 a `BUG()` with `CONFIG_BUG_ON_DATA_CORRUPTION` and an immediate panic with `panic_on_warn` \u2014 and the deliberately installed `VFS_PTR_POISON` guarantees a later oops when the leaked inodes are reclaimed."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dcache.c"], "versions": [{"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "20863bb7fbb016379f8227122edfabc5c799bc79", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "8004d4b8cbf1bd68a23c160d57287e177c82cc69", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "7e0c8aaf4e28918abded547a5147c7d52c4af7d2", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "cebfbf40056a4d858b2a3ca59a69936d599bd209", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "eadc49999fa994d6fbd70c332bd5d5051cc42261", "status": "affected", "versionType": "git"}, {"version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "56094ad3eaa21e6621396cc33811d8f72847a834", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/dcache.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.196", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.196"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.17.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4"}, {"url": "https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79"}, {"url": "https://git.kernel.org/stable/c/8004d4b8cbf1bd68a23c160d57287e177c82cc69"}, {"url": "https://git.kernel.org/stable/c/7e0c8aaf4e28918abded547a5147c7d52c4af7d2"}, {"url": "https://git.kernel.org/stable/c/cebfbf40056a4d858b2a3ca59a69936d599bd209"}, {"url": "https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b"}, {"url": "https://git.kernel.org/stable/c/eadc49999fa994d6fbd70c332bd5d5051cc42261"}, {"url": "https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834"}], "title": "vfs: Don't leak disconnected dentries on umount", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:37:36.894Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:57.898376Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:37.993Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:37:36.894Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:57.898376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:56:58.928Z"}}], "cna": {"title": "vfs: Don't leak disconnected dentries on umount", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered through the `open_by_handle_at()` syscall (and the attacker must also drive the `umount` that converts the dentry leak into the busy-inode/superblock use-after-free), both of which require local system access. The nfsd file-handle path reaches the same code remotely but only produces the reclaimable leak, since a remote client cannot trigger the unmount.\nAC:L - With a malicious FUSE server (or a crafted/corrupt filesystem image, as in the syzbot reproducer) the attacker fully controls `get_parent()`, the readdir entry name, and the `lookup()` result, so the `tmp != dentry` mismatch in `reconnect_one()` is produced deterministically with no race to win. Even the alternate rename-race variant is driven by both sides under attacker control.\nPR:L - `may_decode_fh()` accepts `ns_capable(s_user_ns, CAP_SYS_ADMIN)` for `O_DIRECTORY` handles since v6.11, and FUSE is `FS_USERNS_MOUNT` with export ops enabled by a server-supplied flag, so an ordinary unprivileged user can satisfy every gate inside their own user namespace on their own mount. No real root in the initial namespace is needed.\nUI:N - The attacker performs the mount, the `open_by_handle_at()` call, and the unmount entirely themselves within their own user/mount namespace. No victim action is involved.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or hypervisor boundary crossed. This is standard in-kernel impact.\nC:H - The leaked dentries survive `generic_shutdown_super()` with `d_sb` pointing at a freed `super_block`, and the poisoned inodes remain on a torn-down superblock \u2014 a use-after-free that lets an attacker who sprays the freed slab read back kernel memory through subsequent dcache walks. Per UAF scoring this is High.\nI:H - The dangling `d_sb`/`d_op` and `list_lru_destroy()`d LRU heads mean later `__dentry_kill()`/`iput_final()` operate on reallocated memory, including indirect calls through `d_op->d_release`/`s_op` in a possibly unloaded module \u2014 a controllable write/control-flow primitive. Use-after-free is scored High for integrity.\nA:H - Unmount reliably produces the `VFS: Busy inodes after unmount` `CHECK_DATA_CORRUPTION` WARN \u2014 a `BUG()` with `CONFIG_BUG_ON_DATA_CORRUPTION` and an immediate panic with `panic_on_warn` \u2014 and the deliberately installed `VFS_PTR_POISON` guarantees a later oops when the leaked inodes are reclaimed."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "20863bb7fbb016379f8227122edfabc5c799bc79", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "8004d4b8cbf1bd68a23c160d57287e177c82cc69", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "7e0c8aaf4e28918abded547a5147c7d52c4af7d2", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "cebfbf40056a4d858b2a3ca59a69936d599bd209", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "eadc49999fa994d6fbd70c332bd5d5051cc42261", "versionType": "git"}, {"status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "lessThan": "56094ad3eaa21e6621396cc33811d8f72847a834", "versionType": "git"}], "programFiles": ["fs/dcache.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.301", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.246", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.196", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.158", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.114", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.55", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.5", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/dcache.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4"}, {"url": "https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79"}, {"url": "https://git.kernel.org/stable/c/8004d4b8cbf1bd68a23c160d57287e177c82cc69"}, {"url": "https://git.kernel.org/stable/c/7e0c8aaf4e28918abded547a5147c7d52c4af7d2"}, {"url": "https://git.kernel.org/stable/c/cebfbf40056a4d858b2a3ca59a69936d599bd209"}, {"url": "https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b"}, {"url": "https://git.kernel.org/stable/c/eadc49999fa994d6fbd70c332bd5d5051cc42261"}, {"url": "https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don't leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn't point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\"VFS: don't keep disconnected dentries on d_anon\")\nwhich removed adding of most disconnected dentries to sb->s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn't marked as disconnected, as in the\nscenario described above, the reclaim doesn't happen and the dentries\nare \"leaked\". Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \"Busy\ninodes after unmount\" bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.301", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.246", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.196", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.158", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.114", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.55", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.5", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:50.794Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40105", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:37:36.894Z", "dateReserved": "2025-04-16T07:20:57.165Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-30T09:48:09.674Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/dcache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "20863bb7fbb016379f8227122edfabc5c799bc79", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "8004d4b8cbf1bd68a23c160d57287e177c82cc69", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "7e0c8aaf4e28918abded547a5147c7d52c4af7d2", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "cebfbf40056a4d858b2a3ca59a69936d599bd209", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "eadc49999fa994d6fbd70c332bd5d5051cc42261", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}, {"lessThan": "56094ad3eaa21e6621396cc33811d8f72847a834", "status": "affected", "version": "f1ee616214cb22410e939d963bbb2349c2570f02", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/dcache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.196", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.158", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.114", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.55", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don't leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn't point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\"VFS: don't keep disconnected dentries on d_anon\")\nwhich removed adding of most disconnected dentries to sb->s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn't marked as disconnected, as in the\nscenario described above, the reclaim doesn't happen and the dentries\nare \"leaked\". Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \"Busy\ninodes after unmount\" bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvfs: No fugar dentries desconectados al desmontar\n\nCuando el usuario llama a open_by_handle_at() en alg\u00fan inodo que no est\u00e1 en cach\u00e9, crearemos un dentry desconectado para \u00e9l. Si dicho dentry es un directorio, exportfs_decode_fh_raw() intentar\u00e1 entonces conectar este dentry al \u00e1rbol de dentries a trav\u00e9s de reconnect_path(). Puede ocurrir por varias razones (como un sistema de archivos corrupto o una condici\u00f3n de carrera con renombrar) que la llamada a lookup_one_unlocked() en reconnect_one() falle en encontrar el dentry que estamos intentando reconectar y en su lugar cree un nuevo dentry bajo el padre. Ahora este dentry no ser\u00e1 marcado como desconectado aunque el padre a\u00fan podr\u00eda estar desconectado (al menos en caso de que esta inconsistencia ocurriera porque el sistema de archivos est\u00e1 corrupto y .. no apunta al directorio padre real). Esto crea inconsistencia en las banderas de desconexi\u00f3n pero hasta donde puedo ver era mayormente inofensivo. Al menos hasta el commit f1ee616214cb ('VFS: no mantener dentries desconectados en d_anon') que elimin\u00f3 la adici\u00f3n de la mayor\u00eda de los dentries desconectados a la lista sb->s_anon. As\u00ed, despu\u00e9s de este commit, la limpieza de los dentries desconectados se basa impl\u00edcitamente en el hecho de que dput() reclamar\u00e1 inmediatamente dichos dentries. Sin embargo, cuando alg\u00fan dentry hoja no est\u00e1 marcado como desconectado, como en el escenario descrito anteriormente, la recuperaci\u00f3n no ocurre y los dentries se 'fugan'. La recuperaci\u00f3n de memoria puede eventualmente reclamarlos, pero de lo contrario permanecen en memoria y si el desmontaje ocurre primero, nos encontramos con el infame error 'Inodos ocupados despu\u00e9s del desmontaje'. Aseg\u00farese de que todos los dentries creados bajo un padre desconectado tambi\u00e9n est\u00e9n marcados como desconectados."}], "id": "CVE-2025-40105", "lastModified": "2026-11-10T13:17:54.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40105", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:56:57.898376Z", "version": "2.0.3"}}]}, "published": "2025-10-30T10:15:34.880", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e0c8aaf4e28918abded547a5147c7d52c4af7d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8004d4b8cbf1bd68a23c160d57287e177c82cc69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5abafd0aa8d7bcb935c8f91e4cfc2f2820759e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cebfbf40056a4d858b2a3ca59a69936d599bd209"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eadc49999fa994d6fbd70c332bd5d5051cc42261"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: vfs: Don't leak disconnected dentries on umount", "id": "2407328", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407328"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40105", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40105\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40105\nhttps://lore.kernel.org/linux-cve-announce/2025103018-CVE-2025-40105-a635@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-10-30T14:37:16.771826+00:00", "updated": "2025-10-30T14:37:16.771849+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}