CVE-2025-40355
- Source
- https://cve.org/CVERecord?id=CVE-2025-40355
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40355.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-40355
- Downstream
- Published
- 2025-12-16T13:30:28.017Z
- Modified
- 2025-12-16T20:35:10.858547Z
- Summary
- sysfs: check visibility before changing group attribute ownership
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
sysfs: check visibility before changing group attribute ownership
Since commit 0c17270f9b92 ("net: sysfs: Implement isvisible for phys(portid, portname, switchid)"), _devchangenetnamespace() can hit WARNON() when trying to change owner of a file that isn't visible. See the trace below:
WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 devchangenetnamespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:devchangenetnamespace+0xb89/0xc30 [...] Call Trace: <TASK> ? if6seqshow+0x30/0x50 dosetlink.isra.0+0xc7/0x1270 ? nlavalidateparse+0x5c/0xcc0 ? securitycapable+0x94/0x1a0 rtnlnewlink+0x858/0xc20 ? updatecurr+0x8e/0x1c0 ? updateentitylag+0x71/0x80 ? schedbalancenewidle+0x358/0x450 ? psitaskswitch+0x113/0x2a0 ? _pfxrtnlnewlink+0x10/0x10 rtnetlinkrcvmsg+0x346/0x3e0 ? schedclock+0x10/0x30 ? _pfxrtnetlinkrcvmsg+0x10/0x10 netlinkrcvskb+0x59/0x110 netlinkunicast+0x285/0x3c0 ? _allocskb+0xdb/0x1a0 netlinksendmsg+0x20d/0x430 syssendmsg+0x39f/0x3d0 ? importiovec+0x2f/0x40 _syssendmsg+0x99/0xe0 _syssendmsg+0x8a/0xf0 dosyscall64+0x81/0x970 ? _sysbind+0xe3/0x110 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? sockallocfile+0x63/0xc0 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? allocfd+0x12e/0x190 ? putunusedfd+0x2a/0x70 ? dosysopenat2+0xa2/0xe0 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? excpagefault+0x7e/0x1a0 entrySYSCALL64afterhwframe+0x76/0x7e [...] </TASK>
Fix this by checking is_visible() before trying to touch the attribute.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40355.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/ac2c526e103285d80a0330b91a318f6c9276d35a
- https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40355.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40355
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced303a42769c4c4d8e5e3ad928df87eb36f8c1fa60Fixedac2c526e103285d80a0330b91a318f6c9276d35aFixedc7fbb8218b4ad35fec0bd2256d2b9c8d60331f33