CVE-2025-40249 addresses a use-after-free vulnerability in the Linux kernel's gpio cdev subsystem. The problem occurs when the final fput() call on a file descriptor defers the release action to a work queue, leaving the reference count at zero. If a GPIO event triggers a notification after the reference count drops but before the .release() callback unregisters the notifier, the system attempts to increment the file's reference count using get_file(), which is unsafe in this context. The fix replaces get_file() with get_file_active(), which returns NULL if the file descriptor is being released or already released, preventing the use-after-free condition.

This vulnerability can lead to a use-after-free condition in the Linux kernel, potentially causing memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). An attacker with local privileges could exploit this to cause system instability or escalate privileges.

The vulnerability has been resolved in the Linux kernel by changing the code to use get_file_active() instead of get_file() to ensure the file descriptor is active before use. Although no explicit patch links are provided here, users should apply the official Linux kernel updates that include this fix. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel security advisories for the current remediation guidance.