{"id":"CVE-2025-40130","revision":"51b8251f52e2440484b42e51604e7fd2","records":[{"revision":"51b8251f52e2440484b42e51604e7fd2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-40130","aliases":[],"title":"scsi: ufs: core: Fix data race in CPU latency PM QoS request handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix data race in CPU latency PM QoS request handling\n\nThe cpu_latency_qos_add/remove/update_request interfaces lack internal\nsynchronization by design, requiring the caller to ensure thread safety.\nThe current implementation relies on the 'pm_qos_enabled' flag, which is\ninsufficient to prevent concurrent access and cannot serve as a proper\nsynchronization mechanism. This has led to data races and list\ncorruption issues.\n\nA typical race condition call trace is:\n\n[Thread A]\nufshcd_pm_qos_exit()\n  --> cpu_latency_qos_remove_request()\n    --> cpu_latency_qos_apply();\n      --> pm_qos_update_target()\n        --> plist_del              <--(1) delete plist node\n    --> memset(req, 0, sizeof(*req));\n  --> hba->pm_qos_enabled = false;\n\n[Thread B]\nufshcd_devfreq_target\n  --> ufshcd_devfreq_scale\n    --> ufshcd_scale_clks\n      --> ufshcd_pm_qos_update     <--(2) pm_qos_enabled is true\n        --> cpu_latency_qos_update_request\n          --> pm_qos_update_target\n            --> plist_del          <--(3) plist node use-after-free\n\nIntroduces a dedicated mutex to serialize PM QoS operations, preventing\ndata races and ensuring safe access to PM QoS resources, including sysfs\ninterface reads.","state":0,"publishedAt":"2025-11-12T10:23:21.605+00:00","modifiedAt":"2026-10-21T12:37:48.51+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/ufs/core/ufs-sysfs.c\",\n                        \"drivers/ufs/core/ufshcd.c\",\n                        \"include/ufs/ufshcd.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2777e73fc154e2e87233bdcc0e2402b33815198e\",\n                            \"lessThan\": \"eee1b13526b8f1e6a2402973d95f9fa854771f57\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2777e73fc154e2e87233bdcc0e2402b33815198e\",\n                            \"lessThan\": \"d9df61afb8d23c475f1be3c714da2c34c156ab01\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2777e73fc154e2e87233bdcc0e2402b33815198e\",\n                            \"lessThan\": \"79dde5f7dc7c038eec903745dc1550cd4139980e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/ufs/core/ufs-sysfs.c\",\n                        \"drivers/ufs/core/ufshcd.c\",\n                        \"include/ufs/ufshcd.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.3\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/eee1b13526b8f1e6a2402973d95f9fa854771f57","https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01","https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40130","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-40130","identifiers":["CVE-2025-40130"]},"retained":false,"historicalAffected":[]}],"coverage":[]}