CVE-2025-40259: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40259 is a sleep-in-atomic-context vulnerability in the Linux kernel's SCSI generic (sg) driver. The flaw occurs because sg_finish_rem_req() calls blk_rq_unmap_user(), a function that may sleep, while interrupts are disabled — an invalid operation in an atomic context. It affects the Linux kernel from version 4.12 onward, with patches available for stable branches including 5.4.302, 6.6.118, 6.12.60, 6.17.10, and 6.18. The vulnerability was published on December 4, 2025, and carries a CVSS v3.1 base score of 6.2 (Medium) (Microsoft MSRC, Feedly).

The root cause is improper handling of execution context (CWE-sleep-in-atomic / improper synchronization) in the Linux kernel's drivers/scsi/sg.c. Specifically, sg_finish_rem_req() is invoked with interrupts disabled, but it internally calls blk_rq_unmap_user(), which may call functions that sleep — a behavior prohibited in atomic/interrupt-disabled contexts. This can trigger a kernel BUG or panic when the sleeping function is reached under the wrong context. The attack vector is local (an unprivileged user interacting with a SCSI generic device node), requiring no special privileges or user interaction (Microsoft MSRC, Feedly). The fix restructures the call so that sg_finish_rem_req() is invoked with interrupts enabled.

Successful triggering of this vulnerability results in a kernel panic or system crash, causing a complete loss of availability for the affected system. There is no confidentiality or integrity impact — the CVSS score reflects a high availability impact only. Systems using SCSI generic devices (e.g., tape drives, scanners, or other SCSI peripherals) are most directly at risk, and exploitation could be used as a local denial-of-service primitive (Microsoft MSRC, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is extremely low at 0.000180, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to update to a patched Linux kernel version. Fixes have been backported to the following stable branches: 5.4.302, 6.6.118, 6.12.60, 6.17.10, and 6.18 (Microsoft MSRC). Distribution-specific updates are available from Ubuntu (USN-8096-1/2/3/5, USN-8094-2/3/4/5, USN-8152-1), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), Oracle Linux, and SUSE. Microsoft has also issued an update for Azure Linux 3 (azl3_kernel). As a workaround where patching is not immediately possible, restricting local user access to SCSI generic device nodes (e.g., /dev/sg*) can reduce exposure.