CVE-2025-40201

Vulnerability

Description

CVE-2025-40201 is a race condition vulnerability in the Linux kernel's sys_prlimit64() system call, specifically within the do_prlimit() function. The root cause is the unsafe use of task_lock(tsk->group_leader) when the target task (tsk) is not the current task and is not a thread group leader. The get_task_struct(tsk) call only protects the task_struct itself, but if the process exits or execs, the group_leader pointer may point to a freed task_struct`, leading to a use-after-free condition [1].

Exploitation

An attacker can exploit this by invoking sys_prlimit64() on a non-leader thread that is concurrently exiting or performing an exec (mt-exec). This race can cause the kernel to access freed memory or take the wrong lock. Additionally, the ->group_leader pointer can change during the execution of do_prlimit(), potentially between task_lock() and task_unlock(), resulting in inconsistent locking [1]. The attack requires local access and the ability to trigger the race condition.

Impact

Successful exploitation could lead to a denial of service (system crash) or, kernel panic) or potentially arbitrary code execution due to memory corruption. The vulnerability affects the integrity and availability of the system.

Mitigation

The fix, committed to the Linux kernel stable tree, changes sys_prlimit64() to take tasklist_lock when necessary to protect the group_leader pointer. Users should apply the latest kernel updates from their distribution [1]. No workaround is available.