CVE-2025-40024

In the Linux kernel, the following vulnerability has been resolved:

vhost: Take a reference on the task in struct vhost_task.

vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there.

Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.

vhost_task stored a raw task_struct pointer without holding a reference. If the worker thread exited early, a later vhost_task_wake() could touch a freed task_struct, leading to a use-after-free and potential kernel crash or corruption. The fix grabs a reference with get_task_struct() at creation and drops it with put_task_struct() on teardown, ensuring the pointer remains valid even if the thread exits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The issue can only be triggered by privileged processes that have access to /dev/vhost-* devices (typically QEMU/KVM or other virtualization backends). If Kvm or Qemu not being used, then regular user cannot trigger it. Regular unprivileged users cannot reach this code path because vhost_task_create() is invoked only within the kernel when a vhost device is opened by a process with sufficient capabilities (e.g., root or CAP_NET_ADMIN). Therefore, systems where unprivileged users have no access to /dev/vhost-* are not directly exploitable.