CVE-2025-40201
Description
A flaw was found in the Linux kernel’s sys_prlimit64() implementation in kernel/sys.c. When a non-leader task (tsk) is passed in, the code calls get_task_struct(tsk) but then subsequently calls task_lock(tsk->group_leader), which may have already been freed if the task has exited or executed. In addition, ->group_leader may be changed via mt-exec, so do_prlimit() may take an incorrect lock or operate on a freed structure. A local attacker with the ability to call sys_prlimit64() on another task may trigger a race condition, potentially leading to a denial-of-service (kernel crash) situation.
Statement
This vulnerability is rated as Moderate severity because it requires local system access and relies on winning a race condition against concurrently executing threads, limiting the reliability and scope of attack. In standard Red Hat Enterprise Linux environments, an attacker must have sufficient privileges to target another running process during thread state transitions or process replacement. While successful exploitation can result in a denial of service through a kernel crash, it does not permit remote access or direct administrative privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
