CVE-2025-40355: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40355 is a Linux kernel vulnerability in the sysfs subsystem where __dev_change_net_namespace() triggers a WARN_ON() when attempting to change the ownership of a sysfs group attribute file that is not visible. The issue was introduced after commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)") and affects Linux kernel versions that include that commit without the corresponding fix. It was published on December 16, 2025, and has an EPSS score of 0.018% (very low), indicating minimal current exploitation probability (Feedly). No CVSS score has been officially assigned at this time.

The root cause is a missing visibility check in the sysfs attribute ownership change path (CWE-754: Improper Check for Unusual or Exceptional Conditions). When __dev_change_net_namespace() iterates over sysfs group attributes to update ownership during a network namespace move, it does not verify whether each attribute is actually visible (i.e., exposed in the filesystem) before attempting the chown operation. This causes a WARN_ON() assertion to fire in net/core/dev.c:12410 when an invisible attribute — such as those conditionally hidden by the is_visible callback introduced for phys_port_id, phys_port_name, and switch_id — is encountered. The fix requires checking attribute visibility before attempting ownership changes, mirroring the logic used when creating or removing sysfs files (Feedly).

The primary impact is a kernel warning (WARN_ON) that can be triggered during network namespace transitions, as observed when tools like incusd (the Incus container daemon) move network interfaces between namespaces. While this does not directly result in privilege escalation or data exfiltration, repeated triggering of WARN_ON can degrade system stability and may produce kernel log noise that obscures legitimate security events. In environments using containers or virtual machines with frequent network namespace operations, this could contribute to availability concerns (Feedly).

Apply the upstream Linux kernel patches referenced by commits ac2c526e103285d80a0330b91a318f6c9276d35a and c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33 in the stable kernel tree, which add a visibility check before changing sysfs group attribute ownership. Distribution-specific updates are available through SUSE (advisory SUSE-2026-0447) and are being tracked by Nessus (plugins 297793, 298231, 298917, 299715) and Qualys. Administrators running container workloads (e.g., Incus, LXC) on affected kernels should prioritize patching, as network namespace transitions are a common trigger for this warning (Feedly, Linux Security).