CVE-2025-40130

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40130", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.170Z", "datePublished": "2025-11-12T10:23:21.605Z", "dateUpdated": "2026-10-21T12:37:48.510Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:37:48.510Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix data race in CPU latency PM QoS request handling\n\nThe cpu_latency_qos_add/remove/update_request interfaces lack internal\nsynchronization by design, requiring the caller to ensure thread safety.\nThe current implementation relies on the 'pm_qos_enabled' flag, which is\ninsufficient to prevent concurrent access and cannot serve as a proper\nsynchronization mechanism. This has led to data races and list\ncorruption issues.\n\nA typical race condition call trace is:\n\n[Thread A]\nufshcd_pm_qos_exit()\n --> cpu_latency_qos_remove_request()\n --> cpu_latency_qos_apply();\n --> pm_qos_update_target()\n --> plist_del <--(1) delete plist node\n --> memset(req, 0, sizeof(*req));\n --> hba->pm_qos_enabled = false;\n\n[Thread B]\nufshcd_devfreq_target\n --> ufshcd_devfreq_scale\n --> ufshcd_scale_clks\n --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true\n --> cpu_latency_qos_update_request\n --> pm_qos_update_target\n --> plist_del <--(3) plist node use-after-free\n\nIntroduces a dedicated mutex to serialize PM QoS operations, preventing\ndata races and ensuring safe access to PM QoS resources, including sysfs\ninterface reads."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs-sysfs.c", "drivers/ufs/core/ufshcd.c", "include/ufs/ufshcd.h"], "versions": [{"version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "lessThan": "eee1b13526b8f1e6a2402973d95f9fa854771f57", "status": "affected", "versionType": "git"}, {"version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "lessThan": "d9df61afb8d23c475f1be3c714da2c34c156ab01", "status": "affected", "versionType": "git"}, {"version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "lessThan": "79dde5f7dc7c038eec903745dc1550cd4139980e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs-sysfs.c", "drivers/ufs/core/ufshcd.c", "include/ufs/ufshcd.h"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eee1b13526b8f1e6a2402973d95f9fa854771f57"}, {"url": "https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01"}, {"url": "https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e"}], "title": "scsi: ufs: core: Fix data race in CPU latency PM QoS request handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufs-sysfs.c", "drivers/ufs/core/ufshcd.c", "include/ufs/ufshcd.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eee1b13526b8f1e6a2402973d95f9fa854771f57", "status": "affected", "version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "versionType": "git"}, {"lessThan": "d9df61afb8d23c475f1be3c714da2c34c156ab01", "status": "affected", "version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "versionType": "git"}, {"lessThan": "79dde5f7dc7c038eec903745dc1550cd4139980e", "status": "affected", "version": "2777e73fc154e2e87233bdcc0e2402b33815198e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufs-sysfs.c", "drivers/ufs/core/ufshcd.c", "include/ufs/ufshcd.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix data race in CPU latency PM QoS request handling\n\nThe cpu_latency_qos_add/remove/update_request interfaces lack internal\nsynchronization by design, requiring the caller to ensure thread safety.\nThe current implementation relies on the 'pm_qos_enabled' flag, which is\ninsufficient to prevent concurrent access and cannot serve as a proper\nsynchronization mechanism. This has led to data races and list\ncorruption issues.\n\nA typical race condition call trace is:\n\n[Thread A]\nufshcd_pm_qos_exit()\n --> cpu_latency_qos_remove_request()\n --> cpu_latency_qos_apply();\n --> pm_qos_update_target()\n --> plist_del <--(1) delete plist node\n --> memset(req, 0, sizeof(*req));\n --> hba->pm_qos_enabled = false;\n\n[Thread B]\nufshcd_devfreq_target\n --> ufshcd_devfreq_scale\n --> ufshcd_scale_clks\n --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true\n --> cpu_latency_qos_update_request\n --> pm_qos_update_target\n --> plist_del <--(3) plist node use-after-free\n\nIntroduces a dedicated mutex to serialize PM QoS operations, preventing\ndata races and ensuring safe access to PM QoS resources, including sysfs\ninterface reads."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: core: Soluciona condici\u00f3n de carrera de datos en el manejo de solicitudes de QoS de PM de latencia de CPU\n\nLas interfaces cpu_latency_qos_add/remove/update_request carecen de sincronizaci\u00f3n interna por dise\u00f1o, lo que requiere que el llamador garantice la seguridad de los hilos. La implementaci\u00f3n actual se basa en el indicador 'pm_qos_enabled', el cual es insuficiente para prevenir el acceso concurrente y no puede servir como un mecanismo de sincronizaci\u00f3n adecuado. Esto ha llevado a condiciones de carrera de datos y problemas de corrupci\u00f3n de listas.\n\nUna traza de llamada de condici\u00f3n de carrera t\u00edpica es:\n\n[Hilo A]\nufshcd_pm_qos_exit()\n --> cpu_latency_qos_remove_request()\n --> cpu_latency_qos_apply();\n --> pm_qos_update_target()\n --> plist_del <--(1) eliminar nodo plist\n --> memset(req, 0, sizeof(*req));\n --> hba->pm_qos_enabled = false;\n\n[Hilo B]\nufshcd_devfreq_target\n --> ufshcd_devfreq_scale\n --> ufshcd_scale_clks\n --> ufshcd_pm_qos_update <--(2) pm_qos_enabled es verdadero\n --> cpu_latency_qos_update_request\n --> pm_qos_update_target\n --> plist_del <--(3) uso despu\u00e9s de liberaci\u00f3n de nodo plist\n\nIntroduce un mutex dedicado para serializar las operaciones de PM QoS, previniendo condiciones de carrera de datos y asegurando el acceso seguro a los recursos de PM QoS, incluyendo las lecturas de la interfaz sysfs."}], "id": "CVE-2025-40130", "lastModified": "2026-10-21T13:18:19.067", "metrics": {}, "published": "2025-11-12T11:15:42.637", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eee1b13526b8f1e6a2402973d95f9fa854771f57"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling", "id": "2414515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414515"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: ufs: core: Fix data race in CPU latency PM QoS request handling\nThe cpu_latency_qos_add/remove/update_request interfaces lack internal\nsynchronization by design, requiring the caller to ensure thread safety.\nThe current implementation relies on the 'pm_qos_enabled' flag, which is\ninsufficient to prevent concurrent access and cannot serve as a proper\nsynchronization mechanism. This has led to data races and list\ncorruption issues.\nA typical race condition call trace is:\n[Thread A]\nufshcd_pm_qos_exit()\n--> cpu_latency_qos_remove_request()\n--> cpu_latency_qos_apply();\n--> pm_qos_update_target()\n--> plist_del <--(1) delete plist node\n--> memset(req, 0, sizeof(*req));\n--> hba->pm_qos_enabled = false;\n[Thread B]\nufshcd_devfreq_target\n--> ufshcd_devfreq_scale\n--> ufshcd_scale_clks\n--> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true\n--> cpu_latency_qos_update_request\n--> pm_qos_update_target\n--> plist_del <--(3) plist node use-after-free\nIntroduces a dedicated mutex to serialize PM QoS operations, preventing\ndata races and ensuring safe access to PM QoS resources, including sysfs\ninterface reads."], "name": "CVE-2025-40130", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40130\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40130\nhttps://lore.kernel.org/linux-cve-announce/2025111254-CVE-2025-40130-c057@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:36.517121+00:00", "updated": "2025-11-12T22:12:36.517152+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}