CVE-2025-40259: scsi: sg: Do not sleep in atomic context
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Do not sleep in atomic context
sgfinishremreq() calls blkrqunmapuser(). The latter function may sleep. Hence, call sgfinishremreq() with interrupts enabled instead of disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure sg_finish_rem_req() is invoked with interrupts enabled (i.e., not called from atomic context). This prevents sleeping in atomic context because sg_finish_rem_req() calls blk_rq_unmap_user(), which may sleep.
Linux kernel scsi: sg driver (sg_finish_rem_req) call/interrupt context = interrupts enabled (non-atomic context)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40259?
CVE-2025-40259 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-40259?
To fix CVE-2025-40259, ensure that you're using an updated version of the Linux kernel that includes the patch addressing this vulnerability.
What does CVE-2025-40259 affect?
CVE-2025-40259 affects the Linux kernel, specifically the SCSI generic (sg) driver.
What could happen if CVE-2025-40259 is exploited?
Exploitation of CVE-2025-40259 may lead to potential denial of service, as it involves incorrect handling of sleep in atomic context.
When was CVE-2025-40259 published?
CVE-2025-40259 was published in late 2025 following its discovery and subsequent resolution.