CVE-2025-40024

Overview

CVE-2025-40024 is a use-after-free vulnerability in the Linux kernel's vhost subsystem. The vhost_task_create() function creates a kernel thread but does not take an additional reference on the task_struct. If the thread exits early due to a signal, the task_struct is freed, leaving a dangling pointer. A subsequent call to vhost_task_wake() can then access the freed memory, leading to a use-after-free condition [1].

Exploitation

An attacker with local access to the vhost device (e.g., via a virtual machine or container using vhost-net) can trigger this bug by sending a signal to the vhost worker thread, causing it to exit prematurely. When the driver later attempts to wake the thread via vhost_task_wake(), it dereferences the freed task_struct pointer, resulting in a kernel memory corruption or crash [1].

Impact

Successful exploitation could lead to arbitrary kernel memory read/write, enabling privilege escalation from a guest or unprivileged context to full kernel control. Alternatively, an attacker could cause a denial of service by crashing the system [1].

Mitigation

The Linux kernel stable tree has released patches to address this issue. Commit d2be773a92874 [1] (and backports for affected stable kernels, see [2], [3], [4]) ensures that a reference is held on the task_struct for the lifetime of vhost_task, preventing the use-after-free. Users should apply the latest stable kernel updates to resolve this vulnerability.