Message-ID: <2025120400-CVE-2025-40231-ae6a@gregkh>
Date: Thu,  4 Dec 2025 16:32:06 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vsock: fix lock inversion in vsock_assign_transport()

Syzbot reported a potential lock inversion deadlock between
vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.

The issue was introduced by commit 687aa0c5581b ("vsock: Fix
transport_* TOCTOU") which added vsock_register_mutex locking in
vsock_assign_transport() around the transport->release() call, that can
call vsock_linger(). vsock_assign_transport() can be called with sk_lock
held. vsock_linger() calls sk_wait_event() that temporarily releases and
re-acquires sk_lock. During this window, if another thread hold
vsock_register_mutex while trying to acquire sk_lock, a circular
dependency is created.

Fix this by releasing vsock_register_mutex before calling
transport->release() and vsock_deassign_transport(). This is safe
because we don't need to hold vsock_register_mutex while releasing the
old transport, and we ensure the new transport won't disappear by
obtaining a module reference first via try_module_get().

The Linux kernel CVE team has assigned CVE-2025-40231 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.240 with commit 8667e8d0eb46bc54fdae30ba2f4786407d3d88eb and fixed in 5.10.246 with commit ce4f856c64f0bc30e29302a0ce41f4295ca391c5
	Issue introduced in 5.15.189 with commit 36a439049b34cca0b3661276049b84a1f76cc21a and fixed in 5.15.196 with commit 09bba278ccde25a14b6e5088a9e65a8717d0cccf
	Issue introduced in 6.1.146 with commit 9ce53e744f18e73059d3124070e960f3aa9902bf and fixed in 6.1.158 with commit b44182c116778feaa05da52a426aeb9da1878dcf
	Issue introduced in 6.6.99 with commit 9d24bb6780282b0255b9929abe5e8f98007e2c6e and fixed in 6.6.115 with commit 42ed0784d11adebf748711e503af0eb9f1e6d81d
	Issue introduced in 6.12.39 with commit ae2c712ba39c7007de63cb0c75b51ce1caaf1da5 and fixed in 6.12.56 with commit 251caee792a21eb0b781aab91362b422c945e162
	Issue introduced in 6.16 with commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf and fixed in 6.17.6 with commit a2a4346eea8b4cb75037dbcb20b98cb454324f80
	Issue introduced in 6.16 with commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf and fixed in 6.18 with commit f7c877e7535260cc7a21484c994e8ce7e8cb6780
	Issue introduced in 6.15.7 with commit 7b73bddf54777fb62d4d8c7729d0affe6df04477

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40231
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/vmw_vsock/af_vsock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ce4f856c64f0bc30e29302a0ce41f4295ca391c5
	https://git.kernel.org/stable/c/09bba278ccde25a14b6e5088a9e65a8717d0cccf
	https://git.kernel.org/stable/c/b44182c116778feaa05da52a426aeb9da1878dcf
	https://git.kernel.org/stable/c/42ed0784d11adebf748711e503af0eb9f1e6d81d
	https://git.kernel.org/stable/c/251caee792a21eb0b781aab91362b422c945e162
	https://git.kernel.org/stable/c/a2a4346eea8b4cb75037dbcb20b98cb454324f80
	https://git.kernel.org/stable/c/f7c877e7535260cc7a21484c994e8ce7e8cb6780

Powered by blists - more mailing lists