Add delta related to CVE-2025-40909

Co-authored-by: Leon Timmermans <[email protected]>
Co-authored-by: Philippe Bruhat (BooK) <[email protected]>

Author: 3 people

pod/perldelta.pod

@@ -1093,6 +1093,16 @@ C<PERL_MAGIC_regex_global> magic type.
 
 =item *
 
+[CVE-2025-40909] Perl threads have a working directory race condition where file operations may target unintended paths
+
+Perl thread cloning had a working directory race condition where file operations may target unintended paths. Perl 5.42 will no longer chdir to each handle.
+
+This problem was reported by Vincent Lefèvre via [L<GH #23010|https://github.com/Perl/perl5/issues/23010>] and assigned [L<CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths|https://lists.security.metacpan.org/cve-announce/msg/30017499/>].
+
+Fixes were provided via [L<GH #23019|https://github.com/Perl/perl5/pull/23019>] and [L<GH #23361|https://github.com/Perl/perl5/pull/23361>].
+
+=item *
+
 Fix null pointer dereference in S_SvREFCNT_dec [L<GH #16627|https://github.com/Perl/perl5/issues/16627>].
 
 =item *