FlawAtlas
Search the atlas
CVE-2025-40024 Not scored

vhost: Take a reference on the task in struct vhost_task.

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.

Exploit probability 0.2%
Published October 24, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

272 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:20172-1
related SUSE-SU-2026:0278-1
related SUSE-SU-2026:0281-1
related SUSE-SU-2026:0293-1
related SUSE-SU-2026:0315-1
related SUSE-SU-2026:20012-1
related SUSE-SU-2026:20015-1
related SUSE-SU-2026:20021-1
related SUSE-SU-2026:20477-1
related SUSE-SU-2026:20498-1
related SUSE-SU-2026:20845-1
related SUSE-SU-2026:20876-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-40024

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.

View original source

05 / REFERENCES

Further evidence