Answer in brief
CVE-2025-40249 records a Unknown severity vulnerability in gpio: cdev: make sure the cdev fd is still active before emitting events. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=40b7c49950bd56c984b1f6722f865b922879260e <dccc6daa8afa0f64c432e4c867f275747e3415e1 || >=40b7c49950bd56c984b1f6722f865b922879260e <d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 | dccc6daa8afa0f64c432e4c867f275747e3415e1, d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 |
| Linux/Linuxgeneric | 6.13 | Not reported |
Published upstream
Dec 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-40249 records a Unknown severity vulnerability in gpio: cdev: make sure the cdev fd is still active before emitting events. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=40b7c49950bd56c984b1f6722f865b922879260e <dccc6daa8afa0f64c432e4c867f275747e3415e1 || >=40b7c49950bd56c984b1f6722f865b922879260e <d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 | dccc6daa8afa0f64c432e4c867f275747e3415e1, d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 |
| Linux/Linuxgeneric | 6.13 | Not reported |
Published upstream
Dec 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.
Quoted source text, attributed separately from HOL analysis.