Skip to main content

Linux Kernel CVE-2025-40201

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local unprivileged access (AV:L/PR:L); AC:H because exploitation depends on winning a narrow exit/exec race; kernel use-after-free yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.8 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:26 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 22:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken.

sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct.

Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock().

Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.

AnalysisAI

Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.

Technical ContextAI

The flaw lives in kernel/sys.c in the implementation of the prlimit64(2) system call, which reads and modifies per-process RLIMIT resource limits. sys_prlimit64() calls get_task_struct(tsk) to pin the target task_struct, but this reference only protects that single structure - not tsk->group_leader, which is a separate task. When the target is not the thread-group leader, the target process can exit or exec and free the leader's task_struct before or during task_lock(tsk->group_leader), producing a use-after-free. A second race occurs against multithreaded exec (de_thread), which reassigns ->group_leader: do_prlimit() may lock a stale leader, or the leader pointer may change between task_lock() and task_unlock(), corrupting lock state. The upstream fix reworks sys_prlimit64() to hold tasklist_lock when necessary so the group_leader pointer and task_struct lifetime are stabilized. This is a classic concurrency/lifetime bug (use-after-free / race condition, CWE-416/CWE-362), though the input lists CWE as N/A and tags it 'Information Disclosure', which understates the integrity/availability impact.

Affected ProductsAI

The affected product is the mainline and stable Linux kernel, specifically the resource-limit handling in kernel/sys.c. Exact vulnerable version ranges are not enumerated in the provided NVD data, which supplies only the stable-tree fix commits (git.kernel.org/stable/c/132f827e7bac7373e1522e89709d70b43cae5342, 19b45c84bd9fd42fa97ff80c6350d604cb871c75, 1bc0d9315ef5296abb2c9fd840336255850ded18, 6796412decd2d8de8ec708213bbc958fab72f143, and a15f37a40145c986cdf289a4b88390f35efdecc4) across multiple stable branches. Distribution exposure is confirmed for Ubuntu via advisories USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1); administrators should consult those notices for the exact Ubuntu kernel package versions fixed. No CPE strings were provided in the input.

RemediationAI

Patch available per vendor advisory: apply the fixed kernel packages from your distribution. Ubuntu users should update to the kernel versions specified in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot into the new kernel. Users building from source should incorporate the upstream stable fixes referenced by the git.kernel.org commits (e.g. 132f827e7bac7373e1522e89709d70b43cae5342 and the related backports) that change sys_prlimit64() to take tasklist_lock; a specific tagged release version is not independently confirmed from the input, so match the backport to your maintained stable branch. Because exploitation requires a local unprivileged account, an effective interim compensating control is to minimize untrusted local users and restrict shell access on multi-tenant systems; there is no practical way to disable the prlimit64 syscall globally without breaking legitimate resource-limit management, so reducing local attack surface (fewer local accounts, containerizing untrusted workloads and using seccomp to filter prlimit64 for them) is the realistic mitigation, at the cost of blocking legitimate use of that syscall inside those sandboxes.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.127 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.114 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.144 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.116 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.161 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.107 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-40201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy