CVE-2025-40231 vsock: fix lock inversion in vsock_assign_transport()
A local attacker can trigger a deadlock in the Linux kernel vsock subsystem, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40231?
CVE-2025-40231 is a vulnerability in Linux, published on 4 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vsock: fix lock inversion in vsock_assign_transport()
Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.
The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created.
Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
Which versions are affected by CVE-2025-40231?
How do I fix CVE-2025-40231?
Apply the vendor's patch.
Is CVE-2025-40231 being exploited?
There is no known exploitation of CVE-2025-40231 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40231, DEBIAN-CVE-2025-40231, GHSA-mpc4-rxjp-4rpf, ROOT-OS-DEBIAN-11-CVE-2025-40231, ROOT-OS-UBUNTU-2404-CVE-2025-40231, UBUNTU-CVE-2025-40231.