Race Condition in Linux Kernel's Group Leader Handling

CVE-2025-40201

What is CVE-2025-40201?

A race condition has been identified in the Linux kernel related to the handling of group leaders during process limits adjustment. Specifically, the vulnerability lies in the sys_prlimit64() function's use of task_lock(tsk->group_leader), which can lead to dereferencing a freed task_struct if the referenced task is not the current one. This occurs when the target task exits or changes execution context, exposing a critical flaw. Additionally, concurrent modifications through mt-exec may alter the group leader during lock operations, potentially resulting in acquiring incorrect locks. The proposed solution involves modifying sys_prlimit64() to utilize tasklist_lock under certain conditions, although this approach is a workaround rather than a complete fix.

References