Linux Kernel CVE-2025-40024

In the Linux kernel, the following vulnerability has been resolved:

vhost: Take a reference on the task in struct vhost_task.

vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there.

Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.

The affected product is the mainline and stable Linux kernel, specifically builds that include the vhost worker/vhost_task code path (used by vhost-net, vhost-scsi, and vhost-vsock). No exact vulnerable version range or CPE was provided in the input; the fix is delivered as stable-tree commits at git.kernel.org (7ce635b3d3aba43296b62b5a2d97c008bc51cbd2, 82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0, afe16653e05db07d658b55245c7a2e0603f136c0, and d2be773a92874a070215b51b730cb2b1eaa8fae2), indicating multiple stable branches received backports. Administrators should map these commit hashes to their distribution's kernel package changelog to determine the exact patched version for their branch.