CVE-2025-40249

CVE-2025-40249 affects the Linux kernel GPIO cdev path. The issue arises when a GPIO change notification is emitted after the file descriptor’s reference count drops to zero but before the .release() callback is executed from the workqueue, leaving the descriptor potentially in use-after-free. Th...

Linux Distros Unpatched Vulnerability : CVE-2025-40249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput on a file descriptor, the release action may be deferred an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use-after-free in lineinfochangednotify The use-after-free issue occurs as follows: When the GPIO chip device file is closed by invoking gpiochrdevrelease, the watchedlines object is freed by bitmapfree. Howeve...