CVE-2025-40105: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40105 is a memory leak vulnerability in the Linux kernel's Virtual File System (VFS) layer, specifically in the dentry management subsystem during unmount operations. The flaw occurs when open_by_handle_at() creates disconnected dentries for directory inodes that are not properly marked as disconnected, preventing correct reclamation and causing memory leaks and "Busy inodes after unmount" errors. It was published on October 30, 2025, and affects the Linux kernel broadly, with confirmed impact on Microsoft Azure Linux 3 kernel versions 6.6.104.2-4 and 6.6.112.1-2, as well as multiple distributions including Debian, Ubuntu, SUSE, Oracle Linux, and Amazon Linux 2. The CVSS v3.1 base score is 7.1 (High) (Red Hat CVE, Feedly).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel VFS dentry reconnection logic. When open_by_handle_at() is called on an uncached inode, exportfs_decode_fh_raw() invokes reconnect_path(), which calls lookup_one_unlocked() in reconnect_one(). If this lookup fails to find the target dentry (e.g., due to a corrupted filesystem or a race with rename), it creates a new dentry under the parent that is not marked as disconnected. After commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon"), cleanup of disconnected dentries relies on dput() immediately reclaiming them; however, unmarked leaf dentries bypass this reclaim path, resulting in leaked dentries that persist until memory pressure forces reclaim. The attack vector is local, requiring low privileges, and the precondition is the ability to call open_by_handle_at() on a filesystem susceptible to this inconsistency (Red Hat CVE).

Successful exploitation by a local low-privileged user can cause progressive memory exhaustion on the affected system, as leaked dentries accumulate without being reclaimed. This leads to increased memory consumption, potential system instability, difficulties or errors during filesystem unmounting ("Busy inodes after unmount"), and possible denial-of-service conditions. Confidentiality impact is rated High due to potential exposure of memory contents, and availability impact is High due to the denial-of-service potential; integrity is not directly affected (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface to authenticated users on affected systems.

• Logs: Kernel log messages containing "Busy inodes after unmount" or similar VFS dentry-related warnings during filesystem unmount operations.
• System Behavior: Unexplained and progressive increase in kernel memory usage (observable via /proc/meminfo or tools like smem, free) without a corresponding increase in user-space processes.
• Process/Syscall: Repeated calls to open_by_handle_at() by low-privileged users on filesystems with potential corruption or unusual directory structures, detectable via auditd syscall auditing.

The fix has been committed to the Linux kernel stable tree across multiple stable branches (referenced in commits 7e0c8aaf4e28, 620f3b0ede9c, 8004d4b8cbf1, and 20863bb7fbb0). Affected users should update to the latest patched kernel version provided by their distribution. Vendor-specific patches have been released for Debian (DSA-6053-1, DLA-4379-1, DLA-4404-1), Ubuntu (USN-8033 series, USN-8034 series, USN-8141-1), SUSE (SUSE-2025-4422-1, SUSE-2025-4505-1, SUSE-2025-4521-1), Oracle Linux, Amazon Linux 2 (ALAS2KERNEL-5.4-2025-114, ALAS2KERNEL-5.15-2025-094, ALAS2KERNEL-5.10-2026-112), and Microsoft Azure Linux 3. As a workaround, restricting local user access to open_by_handle_at() via kernel access controls (e.g., seccomp, AppArmor, or SELinux policies) can reduce exposure (Red Hat CVE, Debian LTS, Ubuntu USN-8033).