CVE-2025-40201

A flaw was found in the Linux kernel’s sys_prlimit64() implementation in kernel/sys.c. When a non-leader task (tsk) is passed in, the code calls get_task_struct(tsk) but then subsequently calls task_lock(tsk->group_leader), which may have already been freed if the task has exited or executed. In addition, ->group_leader may be changed via mt-exec, so do_prlimit() may take an incorrect lock or operate on a freed structure. A local attacker with the ability to call sys_prlimit64() on another task may trigger a race condition, potentially leading to a denial-of-service (kernel crash) situation.

This vulnerability is rated as Moderate severity because it requires local system access and relies on winning a race condition against concurrently executing threads, limiting the reliability and scope of attack. In standard Red Hat Enterprise Linux environments, an attacker must have sufficient privileges to target another running process during thread state transitions or process replacement. While successful exploitation can result in a denial of service through a kernel crash, it does not permit remote access or direct administrative privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.