CVE-2025-40272

A use-after-free race condition was found in the secretmem subsystem of the Linux kernel. When two tasks concurrently fault on the same page in a memfd_secret file, the losing task may free its folio before restoring the direct map entry. This allows the freed page to be reallocated while still unmapped, causing potential memory corruption.

Exploitation requires use of the memfd_secret() syscall with concurrent page faults. This feature is used for storing sensitive data like cryptographic keys. The race window is narrow but could be widened by an attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.