CVE & CISA-KEV Catalog

CVE-2025-40108

UNSCORED

Description

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its dependent commit 86fa39dd6fb7 ("serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms") because the first one causes regression - hang task on Qualcomm RB1 board (QRB2210) and unable to use serial at all during normal boot: INFO: task kworker/u16:0:12 blocked for more than 42 seconds. Not tainted 6.17.0-rc1-00004-g53e760d89498 #9 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u16:0 state:D stack:0 pid:12 tgid:12 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: async async_run_entry_fn Call trace: __switch_to+0xe8/0x1a0 (T) __schedule+0x290/0x7c0 schedule+0x34/0x118 rpm_resume+0x14c/0x66c rpm_resume+0x2a4/0x66c rpm_resume+0x2a4/0x66c rpm_resume+0x2a4/0x66c __pm_runtime_resume+0x50/0x9c __driver_probe_device+0x58/0x120 driver_probe_device+0x3c/0x154 __driver_attach_async_helper+0x4c/0xc0 async_run_entry_fn+0x34/0xe0 process_one_work+0x148/0x290 worker_thread+0x2c4/0x3e0 kthread+0x118/0x1c0 ret_from_fork+0x10/0x20 The issue was reported on 12th of August and was ignored by author of commits introducing issue for two weeks. Only after complaining author produced a fix which did not work, so if original commits cannot be reliably fixed for 5 weeks, they obviously are buggy and need to be dropped.

How to fix

Remediation Available
linuxUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-awsUbuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-gcpUbuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-6.17.0-1003-realtimeUbuntu
Fixed in:6.17.0-1003.4USN-7906-1
linux-image-6.17.0-1004-awsUbuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-6.17.0-1004-aws-64kUbuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-6.17.0-1004-gcpUbuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-6.17.0-1004-gcp-64kUbuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-6.17.0-1005-raspiUbuntu
Fixed in:6.17.0-1005.5USN-7906-3
linux-image-6.17.0-7-genericUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-6.17.0-7-generic-64kUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-awsUbuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-aws-6.17Ubuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-aws-64kUbuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-aws-64k-6.17Ubuntu
Fixed in:6.17.0-1004.4USN-7906-1
linux-image-gcpUbuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-gcp-6.17Ubuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-gcp-64kUbuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-gcp-64k-6.17Ubuntu
Fixed in:6.17.0-1004.4USN-7906-2
linux-image-genericUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-generic-6.17Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-generic-64kUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-generic-64k-6.17Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-generic-64k-hwe-24.04Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-generic-hwe-24.04Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-oem-24.04Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-oem-24.04cUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-raspiUbuntu
Fixed in:6.17.0-1005.5USN-7906-3
linux-image-raspi-6.17Ubuntu
Fixed in:6.17.0-1005.5USN-7906-3
linux-image-realtimeUbuntu
Fixed in:6.17.0-1003.4USN-7906-1
linux-image-realtime-6.17Ubuntu
Fixed in:6.17.0-1003.4USN-7906-1
linux-image-realtime-hwe-24.04Ubuntu
Fixed in:6.17.0-1003.4USN-7906-1
linux-image-virtualUbuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-virtual-6.17Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-image-virtual-hwe-24.04Ubuntu
Fixed in:6.17.0-7.7USN-7906-1
linux-raspiUbuntu
Fixed in:6.17.0-1005.5USN-7906-3
linux-realtimeUbuntu
Fixed in:6.17.0-1003.4USN-7906-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3.1 Vector

No CVSS vector data available.

Exploit Intelligence

0.15%probability of exploitation in 30 days
5thpercentile

Low risk: more likely to be exploited than 5% of all known CVEs.

References

Embed a live status badge for CVE-2025-40108
CVE-2025-40108 severity badge

Markdown

[![CVE-2025-40108](https://tridentstack.com/cve/badge/CVE-2025-40108.svg)](https://tridentstack.com/cve/CVE-2025-40108)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-40108"><img src="https://tridentstack.com/cve/badge/CVE-2025-40108.svg" alt="CVE-2025-40108"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-11-12.