GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40201 (GCVE-0-2025-40201)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08
VLAI
Title
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
Summary
In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct. Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock(). Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 18c91bb2d87268d23868bf13508f5bc9cf04e89a , < 1bc0d9315ef5296abb2c9fd840336255850ded18 (git)
Affected: 18c91bb2d87268d23868bf13508f5bc9cf04e89a , < 132f827e7bac7373e1522e89709d70b43cae5342 (git)
Affected: 18c91bb2d87268d23868bf13508f5bc9cf04e89a , < 19b45c84bd9fd42fa97ff80c6350d604cb871c75 (git)
Affected: 18c91bb2d87268d23868bf13508f5bc9cf04e89a , < 6796412decd2d8de8ec708213bbc958fab72f143 (git)
Affected: 18c91bb2d87268d23868bf13508f5bc9cf04e89a , < a15f37a40145c986cdf289a4b88390f35efdecc4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.157 , ≤ 6.1.* (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1bc0d9315ef5296abb2c9fd840336255850ded18",
              "status": "affected",
              "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
              "versionType": "git"
            },
            {
              "lessThan": "132f827e7bac7373e1522e89709d70b43cae5342",
              "status": "affected",
              "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
              "versionType": "git"
            },
            {
              "lessThan": "19b45c84bd9fd42fa97ff80c6350d604cb871c75",
              "status": "affected",
              "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
              "versionType": "git"
            },
            {
              "lessThan": "6796412decd2d8de8ec708213bbc958fab72f143",
              "status": "affected",
              "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
              "versionType": "git"
            },
            {
              "lessThan": "a15f37a40145c986cdf289a4b88390f35efdecc4",
              "status": "affected",
              "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/sys.c: fix the racy usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64() paths\n\nThe usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64()-\u003edo_prlimit()\npath is very broken.\n\nsys_prlimit64() does get_task_struct(tsk) but this only protects task_struct\nitself. If tsk != current and tsk is not a leader, this process can exit/exec\nand task_lock(tsk-\u003egroup_leader) may use the already freed task_struct.\n\nAnother problem is that sys_prlimit64() can race with mt-exec which changes\n-\u003egroup_leader. In this case do_prlimit() may take the wrong lock, or (worse)\n-\u003egroup_leader may change between task_lock() and task_unlock().\n\nChange sys_prlimit64() to take tasklist_lock when necessary. This is not\nnice, but I don\u0027t see a better fix for -stable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the `prlimit64()` syscall (and pid-targeted setrlimit paths) from a local process; no network or physical vector is involved.\nAC:L - The attacker drives both sides of the race using their own processes \u2014 one loop calling prlimit64() on a non-leader TID while a co-operating multithreaded process repeatedly performs mt-exec or group-exit-and-reap \u2014 and can retry indefinitely until the window is hit.\nPR:L - check_prlimit_permission() grants access on a plain uid/gid match, so any unprivileged local user can target a non-leader thread of a process they own; no CAP_SYS_RESOURCE or root is required, and it works unrestricted inside containers.\nUI:N - The attacker creates the victim threads, the exec/exit, and the racing syscall entirely on their own; no action by any other user is needed.\nS:U - The corruption and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free on a task_struct: update_rlimit_cpu() dereferences the freed leader\u0027s -\u003esighand/-\u003esignal, and an attacker who reallocates the slot via fork() spraying can leverage the dangling-pointer reads for kernel memory disclosure.\nI:H - The UAF gives write primitives \u2014 spin_lock/spin_unlock words written into freed memory plus an attacker-supplied RLIMIT_CPU value written through a dangling sighand/signal pointer \u2014 sufficient to corrupt a reallocated live task_struct and pursue control-flow hijack.\nA:H - The mismatched task_lock()/task_unlock() across a de_thread() leaves a task\u0027s alloc_lock permanently held, deadlocking every subsequent task_lock() user (/proc readers, exec, fs_struct access), and the UAF itself readily oopses/panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:29.919Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1bc0d9315ef5296abb2c9fd840336255850ded18"
        },
        {
          "url": "https://git.kernel.org/stable/c/132f827e7bac7373e1522e89709d70b43cae5342"
        },
        {
          "url": "https://git.kernel.org/stable/c/19b45c84bd9fd42fa97ff80c6350d604cb871c75"
        },
        {
          "url": "https://git.kernel.org/stable/c/6796412decd2d8de8ec708213bbc958fab72f143"
        },
        {
          "url": "https://git.kernel.org/stable/c/a15f37a40145c986cdf289a4b88390f35efdecc4"
        }
      ],
      "title": "kernel/sys.c: fix the racy usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64() paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40201",
    "datePublished": "2025-11-12T21:56:34.063Z",
    "dateReserved": "2025-04-16T07:20:57.178Z",
    "dateUpdated": "2026-08-05T12:08:29.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40201",
      "date": "2026-09-18",
      "epss": "0.00144",
      "percentile": "0.04032"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-07T01:51:54.000Z",
      "cve": "CVE-2025-40201",
      "id": "msrc_CVE-2025-40201",
      "initial_release_date": "2025-11-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "kernel/sys.c: fix the racy usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64() paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40201.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/sys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1bc0d9315ef5296abb2c9fd840336255850ded18",
                    "status": "affected",
                    "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "132f827e7bac7373e1522e89709d70b43cae5342",
                    "status": "affected",
                    "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19b45c84bd9fd42fa97ff80c6350d604cb871c75",
                    "status": "affected",
                    "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6796412decd2d8de8ec708213bbc958fab72f143",
                    "status": "affected",
                    "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a15f37a40145c986cdf289a4b88390f35efdecc4",
                    "status": "affected",
                    "version": "18c91bb2d87268d23868bf13508f5bc9cf04e89a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/sys.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/sys.c: fix the racy usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64() paths\n\nThe usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64()-\u003edo_prlimit()\npath is very broken.\n\nsys_prlimit64() does get_task_struct(tsk) but this only protects task_struct\nitself. If tsk != current and tsk is not a leader, this process can exit/exec\nand task_lock(tsk-\u003egroup_leader) may use the already freed task_struct.\n\nAnother problem is that sys_prlimit64() can race with mt-exec which changes\n-\u003egroup_leader. In this case do_prlimit() may take the wrong lock, or (worse)\n-\u003egroup_leader may change between task_lock() and task_unlock().\n\nChange sys_prlimit64() to take tasklist_lock when necessary. This is not\nnice, but I don\u0027t see a better fix for -stable."
          }
        ],
        "id": "CVE-2025-40201",
        "lastModified": "2026-07-30T06:24:17.230",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T22:15:47.283",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/132f827e7bac7373e1522e89709d70b43cae5342"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19b45c84bd9fd42fa97ff80c6350d604cb871c75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1bc0d9315ef5296abb2c9fd840336255850ded18"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6796412decd2d8de8ec708213bbc958fab72f143"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a15f37a40145c986cdf289a4b88390f35efdecc4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:47:55+00:00",
      "cve": "CVE-2025-40201",
      "id": "CVE-2025-40201",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernel/sys.c: fix the racy usage of task_lock(tsk-\u003egroup_leader) in sys_prlimit64() paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40201.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.