Linux Kernel Vulnerability in SCSI Driver Functions

CVE-2025-40259

What is CVE-2025-40259?

A vulnerability in the Linux kernel's SCSI driver functions occurs when sg_finish_rem_req() is executed. The blk_rq_unmap_user() function called within this context is capable of entering a sleep state, which can lead to unintended consequences in a multi-threaded environment. By ensuring that sg_finish_rem_req() is called with interrupts enabled, this issue is mitigated, enhancing the overall stability and security of the kernel's SCSI subsystem.

References