Lock Inversion Vulnerability in Linux Kernel's VSOCK Transport System

CVE-2025-40231

What is CVE-2025-40231?

A vulnerability in the Linux kernel's VSOCK transport system can lead to a lock inversion deadlock. This issue arises during the execution of vsock_linger() when there is a potential circular dependency between vsock_register_mutex and sk_lock-AF_VSOCK. The problem was introduced in a previous commit which altered how locks are managed around transport release calls. The resolution involves adjusting lock handling to prevent deadlock conditions while ensuring module references are correctly managed.

References