CVE-2025-40007

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: fix reference leak

Commit 20d72b00ca81 ("netfs: Fix the request's work item to not

require a ref") modified netfs_alloc_request() to initialize the

reference counter to 2 instead of 1. The rationale was that the

requet's "work" would release the second reference after completion

(via netfs_{read,write}_collection_worker()). That works most of the

time if all goes well.

However, it leaks this additional reference if the request is released

before the I/O operation has been submitted: the error code path only

decrements the reference counter once and the work item will never be

queued because there will never be a completion.

This has caused outages of our whole server cluster today because

tasks were blocked in netfs_wait_for_outstanding_io(), leading to

deadlocks in Ceph (another bug that I will address soon in another

patch). This was caused by a netfs_pgpriv2_begin_copy_to_cache() call

which failed in f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References