CVE-2025-40105: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's Virtual File System (VFS) has been identified as CVE-2025-40105. The issue involves leaking disconnected dentries during unmount operations when using open_by_handle_at() on uncached inodes (Debian Tracker).

The vulnerability occurs when open_by_handle_at() is called on an uncached inode, creating a disconnected dentry. For directory dentries, exportfs_decode_fh_raw() attempts to connect the dentry to the tree through reconnect_path(). If lookup_one_unlocked() in reconnect_one() fails to find the target dentry, it creates a new one under the parent without marking it as disconnected, despite the parent potentially still being disconnected. This inconsistency became problematic after commit f1ee616214cb which removed disconnected dentries from the sb->s_anon list (Debian Tracker).

The vulnerability results in memory leaks as the dentries are not properly reclaimed. This can lead to the 'Busy inodes after unmount' error condition when attempting to unmount the affected filesystem (Debian Tracker).

The issue has been fixed in Linux kernel version 6.17.7-2 and later. The fix ensures that all dentries created under a disconnected parent are properly marked as disconnected (Debian Tracker).