CVE-2025-40270

A flaw was found in the Linux kernel’s memory management swap and VMA (Virtual Memory Area) readahead implementation. Due to the way __read_swap_cache_async and VMA readahead walk page tables and reference swap devices, the code could invoke the helper on a swap device for which no reference was held. Under a race condition where a swap device is being removed (swapoff) concurrently with readahead activity, this can lead to a use-after-free condition on the swap device object.

A Moderate severity use-after-free flaw exists in the Linux kernel's memory management swap subsystem, in the VMA (Virtual Memory Area) readahead path. When VMA readahead walks the page table during swapin, it can encounter swap entries belonging to a different swap device than the target entry and call __read_swap_cache_async on that device without holding a reference to it. If swapoff of one swap device races with swapin on another, the swap device structure can be freed while still being accessed, resulting in a use-after-free that could cause memory corruption or crash the kernel. Red Hat rates this flaw Moderate because exploitation requires local access, low privileges, and winning a narrow timing race between concurrent swapoff and swapin operations; this is reflected in the Red Hat CVSS 3.1 score of 5.8 (AV:L/AC:H/PR:L), which differs from the upstream NVD score of 7.8 (Important). Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in the shipped kernel versions. The RHEL 6 Extended Lifecycle Support stream is recorded for this issue as out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.