PT-2025-43620 · Linux+2 · Linux Kernel+2
Published
2025-10-24
·
Updated
2026-05-07
·
CVE-2025-40024
CVSS v2.0
4.9
Medium
| Vector | AV:A/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains an issue where a race condition can occur within the vhost subsystem. Specifically,
vhost task create() creates a task and maintains a reference to its task struct. If this task terminates prematurely due to a signal, its task struct is released. A subsequent call to vhost task wake() may then attempt to access this already released task struct, leading to a potential error. The resolution involves acquiring a reference to the task struct during thread creation and releasing it when the vhost task structure is removed, ensuring that vhost task wake() always accesses a valid task struct even if the task exits early.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu