Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-40231

vsock: fix lock inversion in vsock_assign_transport()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.10.240 · fixed in 5.10.246; From 5.15.189 · fixed in 5.15.196; From 6.1.146 · fixed in 6.1.158; From 6.6.99 · fixed in 6.6.115; From 6.12.39 · fixed in 6.12.56; From 6.15.7 · fixed in 6.16

  • Linux Linux

    6.16

References 7

git.kernel.org