CVE-2025-40355: sysfs: check visibility before changing group attribute ownership
In the Linux kernel, the following vulnerability has been resolved:
sysfs: check visibility before changing group attribute ownership
Since commit 0c17270f9b92 ("net: sysfs: Implement isvisible for phys(portid, portname, switchid)"), devchangenetnamespace() can hit WARNON() when trying to change owner of a file that isn't visible. See the trace below:
WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 devchangenetnamespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:devchangenetnamespace+0xb89/0xc30 [...] Call Trace: <TASK> ? if6seqshow+0x30/0x50 dosetlink.isra.0+0xc7/0x1270 ? nlavalidateparse+0x5c/0xcc0 ? securitycapable+0x94/0x1a0 rtnlnewlink+0x858/0xc20 ? updatecurr+0x8e/0x1c0 ? updateentitylag+0x71/0x80 ? schedbalancenewidle+0x358/0x450 ? psitaskswitch+0x113/0x2a0 ? pfxrtnlnewlink+0x10/0x10 rtnetlinkrcvmsg+0x346/0x3e0 ? schedclock+0x10/0x30 ? pfxrtnetlinkrcvmsg+0x10/0x10 netlinkrcvskb+0x59/0x110 netlinkunicast+0x285/0x3c0 ? allocskb+0xdb/0x1a0 netlinksendmsg+0x20d/0x430 syssendmsg+0x39f/0x3d0 ? importiovec+0x2f/0x40 syssendmsg+0x99/0xe0 syssendmsg+0x8a/0xf0 dosyscall64+0x81/0x970 ? sysbind+0xe3/0x110 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? sockallocfile+0x63/0xc0 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? allocfd+0x12e/0x190 ? putunusedfd+0x2a/0x70 ? dosysopenat2+0xa2/0xe0 ? syscallexitwork+0x143/0x1b0 ? dosyscall64+0x244/0x970 ? excpagefault+0x7e/0x1a0 entrySYSCALL64afterhwframe+0x76/0x7e [...] </TASK>
Fix this by checking isvisible() before trying to touch the attribute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1006.7~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-14.14 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-14.14.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40355?
CVE-2025-40355 has been rated as a high severity vulnerability due to its impact on the Linux kernel's group attribute ownership management.
How do I fix CVE-2025-40355?
To resolve CVE-2025-40355, update your Linux kernel to version 6.17.1 or later where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-40355?
CVE-2025-40355 affects Linux kernel versions prior to 6.17.1.
What is the impact of exploiting CVE-2025-40355?
Exploiting CVE-2025-40355 can potentially allow unauthorized access to change group attribute ownership, compromising system integrity.
Who is responsible for the fix related to CVE-2025-40355?
The fix for CVE-2025-40355 has been implemented by the Linux kernel development community.