---
id: CVE-2025-40130
title: 'scsi: ufs: core: Fix data race in CPU latency PM QoS request handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: ufs: core: Fix data race in CPU latency PM QoS request handling

  The cpu_latency_qos_add/remove/update_request interfaces lack internal
  synchronization by design,…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e <
    eee1b13526b8f1e6a2402973d95f9fa854771f57
  - >-
    Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e <
    d9df61afb8d23c475f1be3c714da2c34c156ab01
  - >-
    Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e <
    79dde5f7dc7c038eec903745dc1550cd4139980e
  - Linux 6.9
published: '2025-11-12'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:48.510Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40130'
references:
  - url: 'https://git.kernel.org/stable/c/eee1b13526b8f1e6a2402973d95f9fa854771f57'
  - url: 'https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01'
  - url: 'https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e'
tags:
  - cve.org
epss: 0.00238
epssPercentile: 0.14765
ingestedAt: '2026-10-21T12:48:53.682Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix data race in CPU latency PM QoS request handling

The cpu_latency_qos_add/remove/update_request interfaces lack internal
synchronization by design, requiring the caller to ensure thread safety.
The current implementation relies on the 'pm_qos_enabled' flag, which is
insufficient to prevent concurrent access and cannot serve as a proper
synchronization mechanism. This has led to data races and list
corruption issues.

A typical race condition call trace is:

[Thread A]
ufshcd_pm_qos_exit()
  --> cpu_latency_qos_remove_request()
    --> cpu_latency_qos_apply();
      --> pm_qos_update_target()
        --> plist_del              <--(1) delete plist node
    --> memset(req, 0, sizeof(*req));
  --> hba->pm_qos_enabled = false;

[Thread B]
ufshcd_devfreq_target
  --> ufshcd_devfreq_scale
    --> ufshcd_scale_clks
      --> ufshcd_pm_qos_update     <--(2) pm_qos_enabled is true
        --> cpu_latency_qos_update_request
          --> pm_qos_update_target
            --> plist_del          <--(3) plist node use-after-free

Introduces a dedicated mutex to serialize PM QoS operations, preventing
data races and ensuring safe access to PM QoS resources, including sysfs
interface reads.

## Affected

- `Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e < eee1b13526b8f1e6a2402973d95f9fa854771f57`
- `Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e < d9df61afb8d23c475f1be3c714da2c34c156ab01`
- `Linux >= 2777e73fc154e2e87233bdcc0e2402b33815198e < 79dde5f7dc7c038eec903745dc1550cd4139980e`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.