CVE-2025-40271

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/proc: fix uaf in proc_readdir_de()

Pde is erased from subdir rbtree through rb_erase(), but not set the node

to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()

set the erased node to EMPTY, then pde_subdir_next() will return NULL to

avoid uaf access.

We found an uaf issue while using stress-ng testing, need to run testcase

getdent and tun in the same time. The steps of the issue is as follows:

1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current

pde is tun3;

2) in the [time windows] unregister netdevice tun3 and tun2, and erase

them from rbtree. erase tun3 first, and then erase tun2. the

pde(tun2) will be released to slab;

3) continue to getdent process, then pde_subdir_next() will return

pde(tun2) which is released, it will case uaf access.

CPU 0 | CPU 1

---------------------------------------------------------------

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References