Linux kernel vhost: missing task reference lets vhost_task_wake() touch a freed task_struct

Impact

vhost_task_create() stored a pointer to the worker task_struct without taking a reference. If that task exited early on a signal, its task_struct was freed while vhost still held the pointer, and a later vhost_task_wake() dereferenced freed memory. This is the kernel-side worker behind vhost-net and vhost-scsi, so it is in the path of every KVM guest on a node that does virtio offload - the common shape for GPU clouds that hand out whole or partitioned GPUs inside VMs. A use-after-free in host kernel context is a host-integrity problem: at minimum it panics the hypervisor and takes every co-resident VM with it.

Who can reach it

Local on the host: a process that can create vhost workers (the VMM, typically QEMU with access to /dev/vhost-net or /dev/vhost-scsi) and get the worker task killed by a signal during setup. Authentication is required - this is not reachable from a guest or from the network per the record.

What to do

Update to a stable kernel that holds a reference on the task for the lifetime of struct vhost_task (commits in the record) and reboot the hypervisor hosts. Live migration of guests off each host first keeps the window cheap; there is no module reload path for this, since vhost is in use by running VMs.

References

Related entries

• Linux kernel io_uring: waitid entry left on the wait queue races the callback on cancellationCVE-2025-40047 · Linux kernel io_uring waitid (io_waitid_wait wait-queue entry pruning)High
• Linux kernel vhost vringh: copy helper return values checked for negative instead of short copiesCVE-2025-40051 · Linux kernel vhost vringh (copy_from_iter/copy_to_iter return value check)High
• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
• Linux kernel arm_spe: integer overflow in PERF_IDX2OFF with AUX buffers of 2 GiB or moreCVE-2025-40081 · Linux kernel perf arm_spe (PERF_IDX2OFF integer overflow)High
• Linux kernel (drivers/gpu/drm/scheduler): When adding reservation-object dependencies to a job, the helper alreadyCVE-2025-40096 · Linux kernel (drivers/gpu/drm/scheduler)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High