CVE-2025-40130

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: ufs: core: Fix data race in CPU latency PM QoS request handling<br /> <br /> The cpu_latency_qos_add/remove/update_request interfaces lack internal<br /> synchronization by design, requiring the caller to ensure thread safety.<br /> The current implementation relies on the &amp;#39;pm_qos_enabled&amp;#39; flag, which is<br /> insufficient to prevent concurrent access and cannot serve as a proper<br /> synchronization mechanism. This has led to data races and list<br /> corruption issues.<br /> <br /> A typical race condition call trace is:<br /> <br /> [Thread A]<br /> ufshcd_pm_qos_exit()<br /> --&gt; cpu_latency_qos_remove_request()<br /> --&gt; cpu_latency_qos_apply();<br /> --&gt; pm_qos_update_target()<br /> --&gt; plist_del memset(req, 0, sizeof(*req));<br /> --&gt; hba-&gt;pm_qos_enabled = false;<br /> <br /> [Thread B]<br /> ufshcd_devfreq_target<br /> --&gt; ufshcd_devfreq_scale<br /> --&gt; ufshcd_scale_clks<br /> --&gt; ufshcd_pm_qos_update cpu_latency_qos_update_request<br /> --&gt; pm_qos_update_target<br /> --&gt; plist_del