Security readout for executives and security teams
Plain-English summary
A remote client can trigger a locking deadlock in the Linux kernel’s ksmbd SMB server when opening a named pipe. Affected connections or kernel worker tasks may hang, disrupting file-sharing availability. The supplied CVSS score is 7.5 because the issue is network-reachable, requires no privileges or user interaction, and primarily affects availability.
Executive priority
Prioritize internet-facing or broadly reachable ksmbd servers because unauthenticated clients may disrupt availability. Patch them promptly through supported distribution channels. Systems not running ksmbd are unlikely to be exposed. Treat observed hangs as operationally significant, but the supplied evidence does not support confidentiality, integrity, or code-execution impact.
Technical view
ksmbd_session_rpc_open() holds sess->rpc_lock for writing and calls ksmbd_rpc_open(), which reaches ksmbd_session_rpc_method() and attempts a read lock on the same object. This recursive locking deadlocks the worker handling the SMB request. The upstream resolution changes callers so they acquire the lock only when necessary.
Likely exposure
Exposure is limited to Linux systems running ksmbd with SMB reachable by untrusted clients and a kernel containing the vulnerable locking change. The bundle lists relevant commit identifiers and fixed versions 6.12.53 and 6.17.3, but does not provide complete distribution package mappings. Confirm applicability with each Linux distributor.
Exploitation context
The supplied CVSS vector indicates remote, unauthenticated, low-complexity availability impact. The bundle demonstrates reproducible connection and worker hangs, but provides no evidence of data disclosure, modification, code execution, or exploitation in the wild. CVE-2025-40090 is not listed as KEV in the supplied data.
Researcher notes
The regression follows commit 305853cce379, which added locking inside ksmbd_session_rpc_method(). The deadlock path nests down_read() beneath an existing down_write() on sess->rpc_lock. Five stable-kernel fix references are supplied. Exact vulnerable release ranges and downstream backports remain incomplete, so commit or vendor-package analysis is required.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable upstream fix.
- Confirm the distributor’s advisory maps the installed kernel package to the fixed commits.
- Restrict SMB access to trusted networks while updates are pending.
- Disable ksmbd where SMB service is unnecessary, following vendor operational guidance.
Validation and detection
- Determine whether ksmbd is enabled and serving SMB connections.
- Record the running kernel and distribution package versions.
- Compare the package against distributor guidance and the referenced stable fixes.
- Review logs and task diagnostics for hung ksmbd workers or named-pipe connection stalls.
- After updating, confirm normal named-pipe operations without connection or worker hangs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-40090 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7eCVE reference, Linux
- https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02CVE reference, Linux
- https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7CVE reference, Linux
- https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36CVE reference, Linux
- https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.