CVE-2025-40231vsock: fix lock inversion in vsock_assign_transport()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- May 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8667e8d0eb46bc54fdae30ba2f4786407d3d88eb before ce4f856c64f0bc30e29302a0ce41f4295ca391c5; 36a439049b34cca0b3661276049b84a1f76cc21a builds before 09bba278ccde25a14b6e5088a9e65a8717d0cccf; from 9ce53e744f18e73059d3124070e960f3aa9902bf before b44182c116778feaa05da52a426aeb9da1878dcf; from 9d24bb6780282b0255b9929abe5e8f98007e2c6e before 42ed0784d11adebf748711e503af0eb9f1e6d81d; from ae2c712ba39c7007de63cb0c75b51ce1caaf1da5 before 251caee792a21eb0b781aab91362b422c945e162; from 687aa0c5581b8d4aa87fd92973e4ee576b550cdf before a2a4346eea8b4cb75037dbcb20b98cb454324f80; from 687aa0c5581b8d4aa87fd92973e4ee576b550cdf before f7c877e7535260cc7a21484c994e8ce7e8cb6780; 7b73bddf54777fb62d4d8c7729d0affe6df04477; and 6 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/ce4f856c64f0bc30e29302a0ce41f4295ca391c5
- https://git.kernel.org/stable/c/09bba278ccde25a14b6e5088a9e65a8717d0cccf
- https://git.kernel.org/stable/c/b44182c116778feaa05da52a426aeb9da1878dcf
- https://git.kernel.org/stable/c/42ed0784d11adebf748711e503af0eb9f1e6d81d
- https://git.kernel.org/stable/c/251caee792a21eb0b781aab91362b422c945e162
- https://git.kernel.org/stable/c/a2a4346eea8b4cb75037dbcb20b98cb454324f80
- https://git.kernel.org/stable/c/f7c877e7535260cc7a21484c994e8ce7e8cb6780
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.