Executive brief
A vulnerability was identified in the Linux kernel's vhost component, which is responsible for high-performance data exchange between virtual machines and the host system. A flaw in how the kernel manages internal tasks could allow a local attacker to trigger a system crash or potentially gain unauthorized access to sensitive information. This occurs when a specific background task exits unexpectedly, leaving the system in an unstable state when it tries to interact with that task.
Technical details
A use-after-free vulnerability exists in the Linux kernel's vhost_task implementation. The function vhost_task_create() creates a task and maintains a pointer to its task_struct without incrementing the reference count. If the task exits early due to a signal, the task_struct is released, but a subsequent call to vhost_task_wake() may attempt to access the now-freed memory. This is resolved by properly acquiring a reference to the task_struct during creation and releasing it only when the vhost_task itself is destroyed. The fix ensures that vhost_task_wake() always accesses a valid, albeit potentially exited, task structure.
Affected products
- Linux Linux Kernel 6.4 to 6.6.108, 6.12.49, 6.16.9
Timeline
- 2025-09-18: patched: Initial fix authored by Sebastian Andrzej Siewior
- 2025-10-24: disclosed: CVE published by kernel.org