{"id":"CVE-2025-40061","title":"RDMA/rxe: Fix race in do_task() when draining","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix race in do_task() when draining\n\nWhen do_task() exhausts its iteration budget (!ret), it sets the state\nto TASK_STATE_IDLE to reschedule, without a second…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 85288bcf7ffe11e7b036edf91937bc62fd384076","Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 52edccfb555142678c836c285bf5b4ec760bd043","Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 660b6959c4170637f5db2279d1f71af33a49e49b","Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 8ca7eada62fcfabf6ec1dc7468941e791c1d8729","Linux 6.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:56:38.354420Z"},"published":"2025-10-28","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:37.225Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40061","references":[{"url":"https://git.kernel.org/stable/c/85288bcf7ffe11e7b036edf91937bc62fd384076"},{"url":"https://git.kernel.org/stable/c/52edccfb555142678c836c285bf5b4ec760bd043"},{"url":"https://git.kernel.org/stable/c/660b6959c4170637f5db2279d1f71af33a49e49b"},{"url":"https://git.kernel.org/stable/c/8ca7eada62fcfabf6ec1dc7468941e791c1d8729"}],"tags":["cve.org"],"epss":0.0015,"epssPercentile":0.04089,"ingestedAt":"2026-10-15T22:48:25.544Z","slug":"CVE-2025-40061","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix race in do_task() when draining\n\nWhen do_task() exhausts its iteration budget (!ret), it sets the state\nto TASK_STATE_IDLE to reschedule, without a secondary check on the\ncurrent task->state. This can overwrite the TASK_STATE_DRAINING state\nset by a concurrent call to rxe_cleanup_task() or rxe_disable_task().\n\nWhile state changes are protected by a spinlock, both rxe_cleanup_task()\nand rxe_disable_task() release the lock while waiting for the task to\nfinish draining in the while(!is_done(task)) loop. The race occurs if\ndo_task() hits its iteration limit and acquires the lock in this window.\nThe cleanup logic may then proceed while the task incorrectly\nreschedules itself, leading to a potential use-after-free.\n\nThis bug was introduced during the migration from tasklets to workqueues,\nwhere the special handling for the draining case was lost.\n\nFix this by restoring the original pre-migration behavior. If the state is\nTASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to\nforce a new loop iteration. This allows the task to finish its work, so\nthat a subsequent iteration can reach the switch statement and correctly\ntransition the state to TASK_STATE_DRAINED, stopping the task as intended.\n\n## Affected\n\n- `Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 85288bcf7ffe11e7b036edf91937bc62fd384076`\n- `Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 52edccfb555142678c836c285bf5b4ec760bd043`\n- `Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 660b6959c4170637f5db2279d1f71af33a49e49b`\n- `Linux >= 9b4b7c1f9f54120940e243251e2b1407767b3381 < 8ca7eada62fcfabf6ec1dc7468941e791c1d8729`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}