CVE-2025-40305: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40305 is a vulnerability in the Linux kernel's 9p/trans_fd network filesystem transport layer, specifically in the p9_fd_request() function's handling of pipe read operations and receive thread scheduling. The flaw was introduced when a prior kernel optimization (commit aaec5a95d59615, "pipe_read: don't wake up the writer if the pipe is still full") removed an incidental wakeup that the 9P transport relied upon to reschedule its receive worker when a pipe is full. Affected versions span from the initial kernel commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) up to the patched releases in kernel versions 6.12.58, 6.17.8, and 6.18. It was published on December 8, 2025, with a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper synchronization/scheduling logic (related to CWE-362 or improper resource management) in the p9_read_work() function of the Linux kernel's 9p/trans_fd module. When p9_read_work() is called and m->req_list is empty, it does not set Rworksched or call schedule_work(m->rq). Previously, a side effect of anon_pipe_read() triggered an unnecessary wakeup that called p9_pollwake() → p9_poll_workfn() → p9_poll_mux(), which would detect EPOLLIN and reschedule the receive worker. After the pipe optimization commit removed this side-effect wakeup, the receive thread is no longer kicked when the pipe is full and more data needs to be read. The fix modifies p9_fd_request() to call p9_poll_mux() directly instead of only checking for EPOLLOUT, ensuring the receive thread is properly rescheduled (Red Hat Bugzilla, ENISA EUVD).

Exploitation of this vulnerability by a local, low-privileged attacker could disrupt 9P network filesystem communications, potentially causing denial-of-service conditions where filesystem operations stall or hang when the transport pipe becomes full. In more severe scenarios, improper thread and pipe handling could lead to potential unauthorized data access or manipulation of network filesystem data. The vulnerability's scope is limited to systems using the 9p/trans_fd transport (e.g., VirtFS/Plan 9 filesystem mounts), and there is no evidence of lateral movement capability beyond the affected filesystem subsystem (Red Hat Advisory, ENISA EUVD).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and high attack complexity, further limiting practical risk (Red Hat Advisory).

The primary remediation is to update the Linux kernel to a patched version: 6.12.58, 6.17.8, or 6.18, which include the fix modifying p9_fd_request() to call p9_poll_mux() for proper receive thread scheduling. The specific patch commits are 2e1461034aef99e905a1fe5589aaf00eaea73eee, 242531004d7de8c159f9bfadebe33fe8060b1046, and e8fe3f07a357c39d429e02ca34f740692d88967a. As a workaround where patching is not immediately possible, administrators should restrict local user access to systems using 9P/VirtFS mounts and monitor for unusual filesystem or network communication stalls. Microsoft has also addressed this in the Azure Linux 3 kernel package azl3_kernel_6.6.117.1-1 (Red Hat Bugzilla, Microsoft MSRC, ENISA EUVD).