The vulnerability CVE-2025-40358 in the Linux kernel concerns the RISC-V architecture's stacktrace mechanism where KASAN checks were incorrectly applied to non-current tasks during stack unwinding. This caused KASAN to report out-of-bounds memory access errors, potentially leading to kernel crashes or information disclosure. The issue mirrors a previously resolved problem on the x86 architecture, where disabling KASAN checks for non-current tasks mitigated the vulnerability. The patch for RISC-V applies the same approach, preventing KASAN from checking non-current tasks and thus resolving the issue.

The vulnerability allows an attacker with limited privileges (local access with low complexity) to cause a denial of service (kernel crash) or potentially gain unauthorized access to kernel memory, impacting confidentiality and availability. The CVSS vector indicates low attack complexity and privileges required, no user interaction, and a high impact on confidentiality and availability but no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue has been resolved in the Linux kernel source by disabling KASAN checks for non-current tasks on RISC-V, following the precedent set on x86. Users should monitor official Linux kernel advisories and update to the fixed kernel versions once available.