CVE-2025-40005: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40005 was discovered in the Linux kernel's cadence-quadspi driver, disclosed on October 20, 2025. The vulnerability affects the driver's handling of device unbinding operations during busy states, specifically impacting systems using the cadence-quadspi SPI controller (NVD, Ubuntu).

The vulnerability exists in the cadence-quadspi driver's handling of indirect read and indirect write operations. The driver assumes no force device removal (unbind) operation will occur during these operations, though such removal remains available to root users. When a driver unbinding occurs during operations, it results in a kernel crash. The issue has been assigned a CVSS v3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (RedHat).

When exploited, this vulnerability leads to a kernel crash during device unbinding operations, potentially causing system instability and denial of service. The impact is particularly significant for systems actively using the cadence-quadspi driver for SPI operations (NVD).

A fix has been implemented that introduces refcount tracking for attached devices to the controller. This solution ensures graceful handling of device removal operations by waiting for attached devices to complete their operations before proceeding with removal (NVD).