CVE-2025-40237 — NULL Pointer Dereference in Linux
Severity
3.2LOWOSV
No vectorEPSS
0.0%
top 89.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 4
Latest updateApr 9
Description
In the Linux kernel, the following vulnerability has been resolved:
fs/notify: call exportfs_encode_fid with s_umount
Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while
the overlayfs is being unmounted, can lead to dereferencing NULL ptr.
This issue was found by syzkaller.
Race Condition Diagram:
Thread 1 Thread 2
-------- --------
generic_shutdown_super()
shrink_dcache_for_umount
sb->s_root = NULL
|
| vfs_read()
| inotify_fdinfo()
| * inode get from mark *
| show_mar…
Affected Packages5 packages
▶CVEListV5linux/linuxa1a541fbfa7e97c1100144db34b57553d7164ce5 — 950b604384fd75d62e860bec7135b2b62eb4d508+5