vsock: fix lock inversion in vsock_assign_transport()
Summary
| CVE | CVE-2025-40231 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-12-04 16:16:15 UTC |
| Updated | 2026-10-19 21:10:00 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get(). |
Risk And Classification
EPSS: 0.002070000 probability, percentile 0.101580000 (date 2026-10-19)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 8667e8d0eb46bc54fdae30ba2f4786407d3d88eb ce4f856c64f0bc30e29302a0ce41f4295ca391c5 git | Not specified |
| CNA | Linux | Linux | affected 36a439049b34cca0b3661276049b84a1f76cc21a 09bba278ccde25a14b6e5088a9e65a8717d0cccf git | Not specified |
| CNA | Linux | Linux | affected 9ce53e744f18e73059d3124070e960f3aa9902bf b44182c116778feaa05da52a426aeb9da1878dcf git | Not specified |
| CNA | Linux | Linux | affected 9d24bb6780282b0255b9929abe5e8f98007e2c6e 42ed0784d11adebf748711e503af0eb9f1e6d81d git | Not specified |
| CNA | Linux | Linux | affected ae2c712ba39c7007de63cb0c75b51ce1caaf1da5 251caee792a21eb0b781aab91362b422c945e162 git | Not specified |
| CNA | Linux | Linux | affected 687aa0c5581b8d4aa87fd92973e4ee576b550cdf a2a4346eea8b4cb75037dbcb20b98cb454324f80 git | Not specified |
| CNA | Linux | Linux | affected 687aa0c5581b8d4aa87fd92973e4ee576b550cdf f7c877e7535260cc7a21484c994e8ce7e8cb6780 git | Not specified |
| CNA | Linux | Linux | affected 7b73bddf54777fb62d4d8c7729d0affe6df04477 git | Not specified |
| CNA | Linux | Linux | affected 5.10.240 5.10.246 semver | Not specified |
| CNA | Linux | Linux | affected 5.15.189 5.15.196 semver | Not specified |
| CNA | Linux | Linux | affected 6.1.146 6.1.158 semver | Not specified |
| CNA | Linux | Linux | affected 6.6.99 6.6.115 semver | Not specified |
| CNA | Linux | Linux | affected 6.12.39 6.12.56 semver | Not specified |
| CNA | Linux | Linux | affected 6.15.7 6.16 semver | Not specified |
| CNA | Linux | Linux | affected 6.16 | Not specified |
| CNA | Linux | Linux | unaffected 6.16 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.246 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.196 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.158 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.115 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.56 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.17.6 6.17.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/a2a4346eea8b4cb75037dbcb20b98cb454324f80 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/251caee792a21eb0b781aab91362b422c945e162 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ce4f856c64f0bc30e29302a0ce41f4295ca391c5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/42ed0784d11adebf748711e503af0eb9f1e6d81d | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/09bba278ccde25a14b6e5088a9e65a8717d0cccf | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f7c877e7535260cc7a21484c994e8ce7e8cb6780 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/b44182c116778feaa05da52a426aeb9da1878dcf | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.