CVE-2025-40231
Description
In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
How to fix
- Linux Linuxce4f856c64f0bc30e29302a0ce41f4295ca391c5, 09bba278ccde25a14b6e5088a9e65a8717d0cccf, b44182c116778feaa05da52a426aeb9da1878dcf, 42ed0784d11adebf748711e503af0eb9f1e6d81d, 251caee792a21eb0b781aab91362b422c945e162, a2a4346eea8b4cb75037dbcb20b98cb454324f80, f7c877e7535260cc7a21484c994e8ce7e8cb6780, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8667e8d0eb46bc54fdae30ba2f4786407d3d88eb ≤ v < ce4f856c64f0bc30e29302a0ce41f4295ca391c5, 36a439049b34cca0b3661276049b84a1f76cc21a ≤ v < 09bba278ccde25a14b6e5088a9e65a8717d0cccf, 9ce53e744f18e73059d3124070e960f3aa9902bf ≤ v < b44182c116778feaa05da52a426aeb9da1878dcf, 9d24bb6780282b0255b9929abe5e8f98007e2c6e ≤ v < 42ed0784d11adebf748711e503af0eb9f1e6d81d, ae2c712ba39c7007de63cb0c75b51ce1caaf1da5 ≤ v < 251caee792a21eb0b781aab91362b422c945e162, 687aa0c5581b8d4aa87fd92973e4ee576b550cdf ≤ v < a2a4346eea8b4cb75037dbcb20b98cb454324f80, 687aa0c5581b8d4aa87fd92973e4ee576b550cdf ≤ v < f7c877e7535260cc7a21484c994e8ce7e8cb6780, 7b73bddf54777fb62d4d8c7729d0affe6df04477, 5.10.240 ≤ v < 5.10.246, 5.15.189 ≤ v < 5.15.196, 6.1.146 ≤ v < 6.1.158, 6.6.99 ≤ v < 6.6.115, 6.12.39 ≤ v < 6.12.56, 6.15.7 ≤ v < 6.16, 6.16 | ce4f856c64f0bc30e29302a0ce41f4295ca391c5, 09bba278ccde25a14b6e5088a9e65a8717d0cccf, b44182c116778feaa05da52a426aeb9da1878dcf, 42ed0784d11adebf748711e503af0eb9f1e6d81d, 251caee792a21eb0b781aab91362b422c945e162, a2a4346eea8b4cb75037dbcb20b98cb454324f80, f7c877e7535260cc7a21484c994e8ce7e8cb6780, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.16 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.