CVE-2025-40270

Root

Cause

The vulnerability resides in the Linux kernel's swap subsystem, specifically in the VMA readahead path. Commit 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning") optimized __read_swap_cache_async by removing internal logic by removing an extra swap device reference acquisition, assuming all callers already hold a reference to the target entry's swap device. However, VMA readahead walks the page table and may encounter swap entries from devices other than the one associated with the original target entry. When it calls __read_swap_cache_async on such a device without first acquiring a reference, a race condition with swapoff on that device can lead to a use-after-free (UAF) [1].

Exploitation

Exploitation requires a race between swapoff of device A and a swap-in operation on device B, where VMA readahead attempts to read swap entries from device A. The attacker must be able to trigger a page fault that initiates VMA readahead while the swap device is being torn down. This is not trivial to reproduce but is theoretically possible [1].

Impact

A successful UAF could allow an attacker to corrupt kernel memory, potentially leading to system crash or privilege escalation. The issue is classified as a high-severity vulnerability due to the possibility of memory corruption [1].

Mitigation

The fix ensures that VMA readahead acquires a reference to the swap device before calling __read_swap_cache_async if the device differs from the target entry's device. The patch has been applied to the stable kernel tree [1]. Users should update to a kernel version containing commit 1c2a936edd71.