CVE-2025-40024 vhost: Take a reference on the task in struct vhost_task.
A use-after-free in the Linux kernel vhost subsystem allows attackers to cause a denial of service or potentially execute code via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40024?
CVE-2025-40024 is a high-severity use after free vulnerability in Linux, published on 24 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vhost: Take a reference on the task in struct vhost_task.
vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there.
Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.
Which versions are affected by CVE-2025-40024?
How do I fix CVE-2025-40024?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-40024 being exploited?
There is no known exploitation of CVE-2025-40024 in the wild and no public exploit code.
Sources
Also known as AZL-68799, BELL-CVE-2025-40024, DEBIAN-CVE-2025-40024, GHSA-798j-2qwm-wpvm, ROOT-OS-DEBIAN-13-CVE-2025-40024, ROOT-OS-UBUNTU-2404-CVE-2025-40024 and 1 more.