Riskcovery

CVE-2025-40024

vhost: Take a reference on the task in struct vhost_task.

State
Published
Severity
7.8 High
Published
Oct 24, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vhost: Take a reference on the task in struct vhost_task.

vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there.

Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f9010dbdce911ee1f1af1398a24b1f9f992e0080 to before 82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0Affected
  • f9010dbdce911ee1f1af1398a24b1f9f992e0080 to before d2be773a92874a070215b51b730cb2b1eaa8fae2Affected
  • f9010dbdce911ee1f1af1398a24b1f9f992e0080 to before 7ce635b3d3aba43296b62b5a2d97c008bc51cbd2Affected
  • f9010dbdce911ee1f1af1398a24b1f9f992e0080 to before afe16653e05db07d658b55245c7a2e0603f136c0Affected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.109 through 6.6.*Not affected
  • 6.12.50 through 6.12.*Not affected
  • 6.16.10 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.