CVE-2025-40039

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: Fix race condition in RPC handle list access<br /> <br /> The &amp;#39;sess-&gt;rpc_handle_list&amp;#39; XArray manages RPC handles within a ksmbd<br /> session. Access to this list is intended to be protected by<br /> &amp;#39;sess-&gt;rpc_lock&amp;#39; (an rw_semaphore). However, the locking implementation was<br /> flawed, leading to potential race conditions.<br /> <br /> In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock<br /> before calling xa_store() and xa_erase(). Since these operations modify<br /> the XArray structure, a write lock is required to ensure exclusive access<br /> and prevent data corruption from concurrent modifications.<br /> <br /> Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()<br /> without holding any lock at all. This could lead to reading inconsistent<br /> data or a potential use-after-free if an entry is concurrently removed and<br /> the pointer is dereferenced.<br /> <br /> Fix these issues by:<br /> 1. Using down_write() and up_write() in ksmbd_session_rpc_open()<br /> to ensure exclusive access during XArray modification, and ensuring<br /> the lock is correctly released on error paths.<br /> 2. Adding down_read() and up_read() in ksmbd_session_rpc_method()<br /> to safely protect the lookup.