cbcvebase.
CVE-2025-40220
published 2025-12-04

CVE-2025-40220: In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when…

PriorityP428high7.8
EPSS
0.19%
8.7th percentile
In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [] request_wait_answer+0x1fe/0x2a0 [fuse] [] __fuse_simple_request+0xd3/0x2b0 [fuse] [] fuse_do_getattr+0xfc/0x1f0 [fuse] [] fuse_file_read_iter+0xbe/0x1c0 [fuse] [] aio_read+0x130/0x1e0 [] io_submit_one+0x542/0x860 [] __x64_sys_io_submit+0x98/0x1a0 [] do_syscall_64+0x37/0xf0 [] entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are waiting for responses from itself: # cat /proc/372210/task/372232/stack [] request_wait_answer+0x1fe/0x2a0 [fuse] [] __fuse_simple_request+0xd3/0x2b0 [fuse] [] fuse_file_put+0x9a/0xd0 [fuse] [] fuse_release+0x36/0x50 [fuse] [] __fput+0xec/0x2b0 [] task_work_run+0x55/0x90 [] syscall_exit_to_user_mode+0xe9/0x100 [] do_syscall_64+0x43/0xf0 [] entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that: "By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion). Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of

Affected

39 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 2.6.32.32 < 2.6.332.6.33
linuxlinux>= 2.6.33.8 < 2.6.342.6.34
linuxlinux>= 2.6.34.10 < 2.6.352.6.35
linuxlinux>= 2.6.35.12 < 2.6.362.6.36
linuxlinux>= 2.6.37.3 < 2.6.382.6.38
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < 548e1f2bac1d4df91a6138f26bb4ab00323fd948548e1f2bac1d4df91a6138f26bb4ab00323fd948
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < cfd1aa3e2b71f3327cb373c45a897c9028c62b35cfd1aa3e2b71f3327cb373c45a897c9028c62b35
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < 83b375c6efef69b1066ad2d79601221e7892745a83b375c6efef69b1066ad2d79601221e7892745a
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < bfd17b6138df0122a95989457d8e18ce0b86165ebfd17b6138df0122a95989457d8e18ce0b86165e
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < b26923512dbe57ae4917bafd31396d22a9d1691ab26923512dbe57ae4917bafd31396d22a9d1691a
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < f19a1390af448d9e193c08e28ea5f727bf3c3049f19a1390af448d9e193c08e28ea5f727bf3c3049
linuxlinux>= 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 < 26e5c67deb2e1f42a951f022fdf5b9f7eb747b0126e5c67deb2e1f42a951f022fdf5b9f7eb747b01
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.158-16.1.158-1
linuxlinux_kernel>= 0 < 6.12.57-16.12.57-1
linuxlinux_kernel>= 0 < 6.17.6-16.17.6-1
linuxlinux_kernel>= 0 < 5.15.0-170.1805.15.0-170.180
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc5.5MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.