CVE-2025-40178

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pid: Add a judgment for ns null in pid_nr_ns

__task_pid_nr_ns

ns = task_active_pid_ns(current);

pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns);

if (pid && ns->level <= pid->level) {

Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns.

For example:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058

Mem abort info:

ESR = 0x0000000096000007

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x07: level 3 translation fault

Data abort info:

ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000

CM = 0, WnR = 0, TnD = 0, TagAccess = 0

GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000

[0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000

psta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References