kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct. Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock(). Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.
CVE-2025-40201
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-40201
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
"lessThan": "1bc0d9315ef5296abb2c9fd840336255850ded18",
"versionType": "git"
},
{
"status": "affected",
"version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
"lessThan": "132f827e7bac7373e1522e89709d70b43cae5342",
"versionType": "git"
},
{
"status": "affected",
"version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
"lessThan": "19b45c84bd9fd42fa97ff80c6350d604cb871c75",
"versionType": "git"
},
{
"status": "affected",
"version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
"lessThan": "6796412decd2d8de8ec708213bbc958fab72f143",
"versionType": "git"
},
{
"status": "affected",
"version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
"lessThan": "a15f37a40145c986cdf289a4b88390f35efdecc4",
"versionType": "git"
}
],
"programFiles": [
"kernel/sys.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.157",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.113",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.54",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.17.4",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/sys.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-40201
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30692 · Revision 1
- Added to Heist Feed
- Publisher date