CVE-2025-40047: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40047 is a vulnerability discovered in the Linux kernel's iouring subsystem, specifically in the iowaitid_wait() function. The vulnerability was disclosed on October 28, 2025, affecting various Linux kernel versions. The issue involves a race condition that occurs when handling wait queue entries during cancellation processes (NVD, RedHat).

The vulnerability exists in the iouring/waitid functionality where the wait queue entry is not properly pruned in iowaitid_wait(). The issue occurs when a cancellation is in progress, which can lead to a race condition with another invocation of the wait queue entry callback. The vulnerability has been assigned a CVSS v3.1 score of 7.0, indicating moderate severity (RedHat).

The vulnerability affects multiple versions of Red Hat Enterprise Linux, including RHEL 10 and RHEL 9, as well as their kernel-rt variants. The issue could potentially lead to system instability or security implications due to the race condition in the kernel's wait queue handling (RedHat).

The vulnerability has been resolved in the Linux kernel by modifying the iowaitidwait() function to always remove the entry from the wait queue entry list for a successful return, regardless of whether a cancellation is in progress (NVD).