Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-40047
CVE-2025-40047:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2025-40047 is a vulnerability discovered in the Linux kernel, specifically in the iouring/waitid subsystem. The vulnerability was disclosed on October 28, 2025, and affects the wait queue entry management in the iowaitid_wait() function (NVD, Ubuntu).
Technical details
The vulnerability occurs in the io_uring/waitid subsystem where the wait queue entry is not properly removed from the wait queue entry list during a successful return. This issue specifically manifests when a cancelation is in progress, which can lead to a race condition with another invocation of the wait queue entry callback (NVD).
Impact
The vulnerability affects various Linux distributions and kernel versions, with Ubuntu marking it as a medium priority issue. Multiple Ubuntu kernel packages including linux-azure, linux-gcp, and linux-hwe-6.14 are marked as vulnerable to this issue (Ubuntu).
Mitigation and workarounds
The vulnerability has been resolved in the Linux kernel through a patch that ensures the wait queue entry is always removed from the list for successful returns, even when a cancelation is in progress (NVD).
Additional resources
Source: This report was generated using AI
Related Linux Kernel vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management