Security readout for executives and security teams
Plain-English summary
A Linux vhost task can exit while another operation still plans to wake it, causing the kernel to access an object already released from memory. The CVSS assessment indicates potential confidentiality, integrity, and availability impact from a local low-privileged attack. The supplied evidence does not establish active exploitation.
Executive priority
Treat this as a high-priority kernel update for affected multi-user or virtualization hosts. The attack is local rather than directly remote, but the stated potential impact covers complete confidentiality, integrity, and availability loss. Prioritize systems allowing untrusted local access, while using vendor backport information to avoid incorrect version-based conclusions.
Technical view
This is a task lifetime-management flaw in Linux vhost. If a signal makes a newly created vhost task exit early, a pending wake operation can access its released task_struct. The stable fixes retain a task reference during creation and release it when the vhost_task is removed, keeping the object valid for pending wake operations.
Likely exposure
Exposure is most plausible on systems running affected Linux kernels where vhost functionality is present and reachable by a local low-privileged user. The supplied version data includes ambiguous entries, including “0” and commit identifiers. Confirm exact exposure and distribution backports through vendor guidance rather than relying solely on upstream version numbers.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. CVE-2025-40024 is not listed as KEV in the supplied bundle, and no cited source establishes active exploitation or a public exploit. Absence from KEV does not prove that exploitation has never occurred.
Researcher notes
The described condition is a task_struct lifetime race resembling use-after-free behavior: early task exit releases the object before a pending vhost_task_wake accesses it. The fix changes reference ownership rather than wake semantics. No CWE, trigger reliability evidence, exploit analysis, or affected-configuration detail is supplied. Version boundaries should be verified against upstream commits and distribution advisories.
Mitigation direction
- Apply a distribution or kernel-vendor update containing the applicable stable fix for CVE-2025-40024.
- Reboot into the updated kernel when required, following vendor maintenance guidance.
- Until patched, reduce untrusted local access and prioritize vhost-using virtualization systems.
- Check vendor guidance before changing or disabling vhost-dependent services.
Validation and detection
- Record the running kernel release and compare it with your distribution's CVE-2025-40024 advisory.
- Verify the installed update contains the applicable referenced stable-kernel fix.
- After maintenance, confirm the host is running the updated kernel, not merely storing it.
- Rescan updated systems and investigate any disagreement between scanner and vendor version mappings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40024 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0CVE reference, Linux
- https://git.kernel.org/stable/c/d2be773a92874a070215b51b730cb2b1eaa8fae2CVE reference, Linux
- https://git.kernel.org/stable/c/7ce635b3d3aba43296b62b5a2d97c008bc51cbd2CVE reference, Linux
- https://git.kernel.org/stable/c/afe16653e05db07d658b55245c7a2e0603f136c0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.