CVE-2025-40024
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.
Statement
vhost_task stored a raw task_struct pointer without holding a reference. If the worker thread exited early, a later vhost_task_wake() could touch a freed task_struct, leading to a use-after-free and potential kernel crash or corruption. The fix grabs a reference with get_task_struct() at creation and drops it with put_task_struct() on teardown, ensuring the pointer remains valid even if the thread exits.
Mitigation
The issue can only be triggered by privileged processes that have access to /dev/vhost-* devices (typically QEMU/KVM or other virtualization backends). If Kvm or Qemu not being used, then regular user cannot trigger it.
Regular unprivileged users cannot reach this code path because vhost_task_create() is invoked only within the kernel when a vhost device is opened by a process with sufficient capabilities (e.g., root or CAP_NET_ADMIN).
Therefore, systems where unprivileged users have no access to /dev/vhost-* are not directly exploitable.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
