CVE-2025-40341

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

futex: Don't leak robust_list pointer on exec race

sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()

to check if the calling task is allowed to access another task's

robust_list pointer. This check is racy against a concurrent exec() in the

target process.

During exec(), a task may transition from a non-privileged binary to a

privileged one (e.g., setuid binary) and its credentials/memory mappings

may change. If get_robust_list() performs ptrace_may_access() before

this transition, it may erroneously allow access to sensitive information

after the target becomes privileged.

A racy access allows an attacker to exploit a window during which

ptrace_may_access() passes before a target process transitions to a

privileged state via exec().

For example, consider a non-privileged task T that is about to execute a

setuid-root binary. An attacker task A calls get_robust_list(T) while T

is still unpr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References