CVE-2025-40047
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40047
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40047.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-40047
- Downstream
- Published
- 2025-10-28T11:48:24.625Z
- Modified
- 2025-11-20T10:30:05.118286Z
- Summary
- io_uring/waitid: always prune wait queue entry in io_waitid_wait()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iouring/waitid: always prune wait queue entry in iowaitid_wait()
For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf31ecf671ddc498f20219453395794ff2383e06bFixed696ba6032081e617564a8113a001b8d7943cb928
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf31ecf671ddc498f20219453395794ff2383e06bFixed3e2205db2f0608898d535da1964e1b376aacfdaa
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf31ecf671ddc498f20219453395794ff2383e06bFixed2f8229d53d984c6a05b71ac9e9583d4354e3b91f
Affected versions
v6.*
v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.39
v6.12.4
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.5
v6.12.50
v6.12.51
v6.12.52
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.16
v6.16-rc1
v6.16-rc2
v6.16-rc3
v6.16-rc4
v6.16-rc5
v6.16-rc6
v6.16-rc7
v6.17
v6.17-rc1
v6.17-rc2
v6.17-rc3
v6.17-rc4
v6.17-rc5
v6.17-rc6
v6.17-rc7
v6.17.1
v6.17.2
v6.6
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"209842399593572624780855770419342858816",
"276850456749999473231602940350144811519",
"137621479232701188604997865609172114882",
"48673805080141410922760996105676347826",
"298597186516496828693455625915929787197",
"144905188882918449954526644132235543119",
"199029787391381951118375320950435921820",
"277586332880868560963193013064507080738"
],
"threshold": 0.9
},
"target": {
"file": "io_uring/waitid.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e2205db2f0608898d535da1964e1b376aacfdaa",
"signature_version": "v1",
"id": "CVE-2025-40047-000f2e55"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"209842399593572624780855770419342858816",
"276850456749999473231602940350144811519",
"137621479232701188604997865609172114882",
"48673805080141410922760996105676347826",
"298597186516496828693455625915929787197",
"144905188882918449954526644132235543119",
"199029787391381951118375320950435921820",
"277586332880868560963193013064507080738"
],
"threshold": 0.9
},
"target": {
"file": "io_uring/waitid.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f8229d53d984c6a05b71ac9e9583d4354e3b91f",
"signature_version": "v1",
"id": "CVE-2025-40047-7d12b9ad"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 591.0,
"function_hash": "62368703475825415585195543822462130975"
},
"target": {
"file": "io_uring/waitid.c",
"function": "io_waitid_wait"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f8229d53d984c6a05b71ac9e9583d4354e3b91f",
"signature_version": "v1",
"id": "CVE-2025-40047-7d4eaa6b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 591.0,
"function_hash": "62368703475825415585195543822462130975"
},
"target": {
"file": "io_uring/waitid.c",
"function": "io_waitid_wait"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e2205db2f0608898d535da1964e1b376aacfdaa",
"signature_version": "v1",
"id": "CVE-2025-40047-bb086636"
}
]