The Linux kernel vulnerability CVE-2025-40047 involves the io_uring subsystem's wait queue management in the io_waitid_wait() function. The issue was that the wait queue entry was not always removed upon successful return if a cancellation was in progress, leading to a race condition with concurrent wait queue callbacks. This could result in severe consequences affecting system confidentiality, integrity, and availability. The vulnerability has been resolved by modifying the code to always prune the wait queue entry regardless of cancellation state.

This vulnerability has a high severity rating with potential impacts on confidentiality, integrity, and availability of the affected system. Exploitation could allow an attacker with local privileges to cause race conditions that may lead to system instability or unauthorized access to kernel resources.

A fix has been implemented in the Linux kernel to address this vulnerability by ensuring the wait queue entry is always pruned in io_waitid_wait(). Users and administrators should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; verify with the Linux kernel vendor advisory for current remediation guidance.