CVE-2025-40341

A race condition flaw was found in the Linux kernel's futex subsystem. The sys_get_robust_list() and compat_get_robust_list() functions use ptrace_may_access() to verify permissions before accessing another task's robust_list pointer. However, this check is not synchronized with concurrent exec() calls in the target process. An attacker can exploit this race window by calling get_robust_list() on a process just before it executes a setuid binary. The permission check passes while the target is unprivileged, but the robust_list pointer is read after the target transitions to privileged state, potentially leaking memory addresses from a privileged process.

This vulnerability requires local access and precise timing to exploit the race condition between ptrace_may_access() and exec(). While the leaked information is limited to robust_list pointers, this could be used as part of a larger exploit chain to bypass address space layout randomization (ASLR) or other security mechanisms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.