CVE-2025-40090

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix recursive locking in RPC handle list access

Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list

access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.

This causes hung connections / tasks when a client attempts to open

a named pipe. Using Samba's rpcclient tool:

$ rpcclient //192.168.1.254 -U user%password

$ rpcclient $> srvinfo

<connection hung here>

Kernel side:

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000

Workqueue: ksmbd-io handle_ksmbd_work

Call trace:

__schedule from schedule+0x3c/0x58

schedule from schedule_preempt_disabled+0xc/0x10

schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8

rwsem_down_read_slowpath from down_read+0x28/0x30

down_read from ksmbd_session_rpc_method+0x18/0x3c

ksmbd_session_rpc_method from ksmbd_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References