« Volver al listado

CVE-2025-40231

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

vsock: fix lock inversion in vsock_assign_transport()

Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.

The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created.

Leer descripción completaMostrar menos

Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40231",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8667e8d0eb46bc54fdae30ba2f4786407d3d88eb",
              "lessThan": "ce4f856c64f0bc30e29302a0ce41f4295ca391c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36a439049b34cca0b3661276049b84a1f76cc21a",
              "lessThan": "09bba278ccde25a14b6e5088a9e65a8717d0cccf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9ce53e744f18e73059d3124070e960f3aa9902bf",
              "lessThan": "b44182c116778feaa05da52a426aeb9da1878dcf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9d24bb6780282b0255b9929abe5e8f98007e2c6e",
              "lessThan": "42ed0784d11adebf748711e503af0eb9f1e6d81d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ae2c712ba39c7007de63cb0c75b51ce1caaf1da5",
              "lessThan": "251caee792a21eb0b781aab91362b422c945e162",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "687aa0c5581b8d4aa87fd92973e4ee576b550cdf",
              "lessThan": "a2a4346eea8b4cb75037dbcb20b98cb454324f80",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "687aa0c5581b8d4aa87fd92973e4ee576b550cdf",
              "lessThan": "f7c877e7535260cc7a21484c994e8ce7e8cb6780",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7b73bddf54777fb62d4d8c7729d0affe6df04477",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.240",
              "lessThan": "5.10.246",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.189",
              "lessThan": "5.15.196",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.1.146",
              "lessThan": "6.1.158",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.6.99",
              "lessThan": "6.6.115",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.12.39",
              "lessThan": "6.12.56",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.15.7",
              "lessThan": "6.16",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-04T16:16:15.870",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/09bba278ccde25a14b6e5088a9e65a8717d0cccf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/251caee792a21eb0b781aab91362b422c945e162",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/42ed0784d11adebf748711e503af0eb9f1e6d81d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a2a4346eea8b4cb75037dbcb20b98cb454324f80",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b44182c116778feaa05da52a426aeb9da1878dcf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ce4f856c64f0bc30e29302a0ce41f4295ca391c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f7c877e7535260cc7a21484c994e8ce7e8cb6780",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: fix lock inversion in vsock_assign_transport()\n\nSyzbot reported a potential lock inversion deadlock between\nvsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.\n\nThe issue was introduced by commit 687aa0c5581b (\"vsock: Fix\ntransport_* TOCTOU\") which added vsock_register_mutex locking in\nvsock_assign_transport() around the transport->release() call, that can\ncall vsock_linger(). vsock_assign_transport() can be called with sk_lock\nheld. vsock_linger() calls sk_wait_event() that temporarily releases and\nre-acquires sk_lock. During this window, if another thread hold\nvsock_register_mutex while trying to acquire sk_lock, a circular\ndependency is created.\n\nFix this by releasing vsock_register_mutex before calling\ntransport->release() and vsock_deassign_transport(). This is safe\nbecause we don't need to hold vsock_register_mutex while releasing the\nold transport, and we ensure the new transport won't disappear by\nobtaining a module reference first via try_module_get()."
    }
  ],
  "lastModified": "2026-06-17T09:21:29.853",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}