Executive brief
A vulnerability in the Linux kernel's process management system could allow a local user to cause a system crash or potentially gain unauthorized access to data. The issue occurs when the system manages resource limits for running programs, specifically failing to properly lock data when a process is exiting or changing its state. This could lead to unpredictable system behavior or a complete service outage on affected Linux servers.
Technical details
A race condition exists in kernel/sys.c within the sys_prlimit64() and do_prlimit() paths. The vulnerability stems from the racy usage of task_lock(tsk->group_leader); while the code protects the task_struct itself via get_task_struct(), it fails to prevent the group_leader from being freed or changed during execution if the target task is not the current task and is not a thread leader. This can occur during a multi-threaded exec (mt-exec) or process exit, leading to a use-after-free of the task_struct or a synchronization error where a lock is acquired on one structure and released on another. The fix involves implementing tasklist_lock during these operations to ensure the task's group leader remains valid.
Affected products
- Linux Linux Kernel 5.18 to 6.17.4
Timeline
- 2025-09-15: patched: Initial fix proposed by Oleg Nesterov
- 2025-11-12: advisory: CVE-2025-40201 published
References
- https://git.kernel.org/stable/c/132f827e7bac7373e1522e89709d70b43cae5342
- https://git.kernel.org/stable/c/19b45c84bd9fd42fa97ff80c6350d604cb871c75
- https://git.kernel.org/stable/c/1bc0d9315ef5296abb2c9fd840336255850ded18
- https://git.kernel.org/stable/c/6796412decd2d8de8ec708213bbc958fab72f143
- https://git.kernel.org/stable/c/a15f37a40145c986cdf289a4b88390f35efdecc4