CVE-2025-40231

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock: fix lock inversion in vsock_assign_transport()

Syzbot reported a potential lock inversion deadlock between

vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.

The issue was introduced by commit 687aa0c5581b ("vsock: Fix

transport_* TOCTOU") which added vsock_register_mutex locking in

vsock_assign_transport() around the transport->release() call, that can

call vsock_linger(). vsock_assign_transport() can be called with sk_lock

held. vsock_linger() calls sk_wait_event() that temporarily releases and

re-acquires sk_lock. During this window, if another thread hold

vsock_register_mutex while trying to acquire sk_lock, a circular

dependency is created.

Fix this by releasing vsock_register_mutex before calling

transport->release() and vsock_deassign_transport(). This is safe

because we don't need to hold vsock_register_mutex while releasing the

old transport, and we ensure the new transport won

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References