CVE-2025-40361: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40361 is a rejected/withdrawn CVE originally associated with a deadlock vulnerability in the Linux kernel's ext4 filesystem subsystem. The issue involved the use of GFP_KERNEL instead of GFP_NOFS in the ext4_xattr_inode_cache_find function, which could cause a deadlock when memory allocation is attempted while holding filesystem locks. The CVE was assigned by the Linux kernel CVE Numbering Authority and published on December 16, 2025, but has since been formally rejected and withdrawn (Feedly, EUVD). The EPSS score is 0.000240, reflecting negligible exploitation probability, and no CVSS base score has been assigned given the rejection status.

The original issue was rooted in an incorrect GFP (Get Free Pages) flag usage in the Linux kernel's ext4 extended attribute (xattr) handling code (CWE-667: Improper Locking). Specifically, ext4_xattr_inode_cache_find used GFP_KERNEL for memory allocation, while its parent function ext4_xattr_inode_lookup_create already used GFP_NOFS — a flag that prevents the allocator from recursing into the filesystem, which is necessary to avoid deadlocks when filesystem locks are held. The fix, backported across multiple stable kernel branches, changes the allocation flag to GFP_NOFS to maintain consistency and prevent potential deadlock scenarios (EUVD). Because the CVE has been rejected, the precise scope and exploitability of the original issue are no longer formally tracked.

As a kernel-level deadlock issue in the ext4 filesystem, the primary impact would have been an availability concern — specifically, a system or process hang when the kernel attempts a memory allocation that triggers filesystem activity while already holding filesystem locks. This could result in an unresponsive system or kernel panic under specific workloads involving ext4 extended attributes. Given the CVE's rejection, no formal impact assessment has been published, and the practical risk to production systems is considered low (Feedly).

Patches addressing the underlying GFP flag issue were backported to multiple Linux stable kernel branches prior to the CVE's rejection: 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Users running affected kernel versions should upgrade to these patched releases. Since the CVE has been formally withdrawn, no additional vendor advisories or workarounds are expected (EUVD).