Security readout for executives and security teams
Plain-English summary
A Linux kernel race can mishandle a process-leader reference while changing resource limits, potentially accessing freed memory. A local, low-privileged attacker may be able to compromise confidentiality, integrity, or availability. Exposure depends on the exact kernel branch and vendor backports.
Executive priority
Prioritize remediation for shared, multi-user, development, hosting, and other systems running untrusted local code. Treat as a high-priority kernel update, while recognizing that supplied evidence does not show remote or active exploitation.
Technical view
sys_prlimit64() protected a task_struct but not necessarily its group_leader. Concurrent process exit or multi-threaded exec could free or replace that leader while do_prlimit() locks it, causing use-after-free or mismatched locking. The stable fix takes tasklist_lock when necessary.
Likely exposure
Potentially exposed systems run an affected Linux kernel and permit untrusted local users or code execution. The bundle lists affected entries including 5.18, 6.1.157, 6.6.113, 6.12.54, 6.17.4, and 6.18, but does not clearly express complete version ranges.
Exploitation context
The CVSS vector indicates local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle says this CVE is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The source describes a concurrency-driven lifetime and locking flaw involving group_leader during prlimit handling. Exact affected ranges are ambiguous in the supplied flattened version data. Validate branch-specific ancestry and distributor backports against the five stable commits; do not infer exposure from version strings alone.
Mitigation direction
- Update to a supported distribution kernel incorporating the applicable cited stable fix.
- Confirm the corrected package with your Linux distributor because kernel fixes are commonly backported.
- Until updated, restrict untrusted local accounts and workloads where operationally feasible.
- Consult vendor guidance for additional mitigations; the supplied sources name no standalone workaround.
Validation and detection
- Inventory running kernel versions across hosts, virtual machines, and appliances.
- Check each distributor's advisory and package changelog for CVE-2025-40201 or a cited fix commit.
- Verify the corrected kernel is running after installation and reboot.
- Rescan affected assets and record vendor-specific backport evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40201 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1bc0d9315ef5296abb2c9fd840336255850ded18CVE reference, Linux
- https://git.kernel.org/stable/c/132f827e7bac7373e1522e89709d70b43cae5342CVE reference, Linux
- https://git.kernel.org/stable/c/19b45c84bd9fd42fa97ff80c6350d604cb871c75CVE reference, Linux
- https://git.kernel.org/stable/c/6796412decd2d8de8ec708213bbc958fab72f143CVE reference, Linux
- https://git.kernel.org/stable/c/a15f37a40145c986cdf289a4b88390f35efdecc4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.