CVE-2025-40027

A flaw was discovered in the Linux kernel’s 9p filesystem client involving a race condition between concurrent request cleanup operations. When the 9p client sends a flush request and later handles cleanup, it may concurrently interact with the p9_read_work() worker, which cancels pending requests. Under these concurrent conditions, both execution paths may attempt to remove a request from the internal request list (req_list) without proper synchronization. This can result in a double removal of the same request, leading to a wild memory access or general protection fault when accessed under a KASAN (Kernel Address Sanitizer) environment.

A MODERATE severity denial of service flaw was found in the Linux kernel's 9p filesystem client. A local user able to mount a 9p filesystem can trigger a race condition between the flush request cleanup path (p9_fd_cancelled) and the p9_read_work() worker that cancels pending requests, allowing both paths to remove the same request from the internal request list without proper synchronization. This double removal results in memory corruption and a kernel crash, affecting only the availability of the system (Red Hat CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The upstream CVE record assigns a higher severity of 7.8 with high confidentiality and integrity impacts, which does not reflect the denial-of-service nature of this flaw established by the available evidence. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope, and the vulnerable code is not present in the kernel and kernel-rt packages of Red Hat Enterprise Linux 7, 8, 9, and 10, nor in the Red Hat In-Vehicle OS kernel packages, so no Red Hat products are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.