CVE-2025-40341futex: Don't leak robust_list pointer on exec race

Description

In the Linux kernel, the following vulnerability has been resolved: futex: Don't leak robust_list pointer on exec race sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer. This check is racy against a concurrent exec() in the target process. During exec(), a task may transition from a non-privileged binary to a privileged one (e.g., setuid binary) and its credentials/memory mappings may change. If get_robust_list() performs ptrace_may_access() before this transition, it may erroneously allow access to sensitive information after the target becomes privileged. A racy access allows an attacker to exploit a window during which ptrace_may_access() passes before a target process transitions to a privileged state via exec(). For example, consider a non-privileged task T that is about to execute a setuid-root binary. An attacker task A calls get_robust_list(T) while T is still unprivileged. Since ptrace_may_access() checks permissions based on current credentials, it succeeds. However, if T begins exec immediately afterwards, it becomes privileged and may change its memory mappings. Because get_robust_list() proceeds to access T->robust_list without synchronizing with exec() it may read user-space pointers from a now-privileged process. This violates the intended post-exec access restrictions and could expose sensitive memory addresses or be used as a primitive in a larger exploit chain. Consequently, the race can lead to unauthorized disclosure of information across privilege boundaries and poses a potential security risk. Take a read lock on signal->exec_update_lock prior to invoking ptrace_may_access() and accessing the robust_list/compat_robust_list. This ensures that the target task's exec state remains stable during the check, allowing for consistent and synchronized validation of credentials.

Timeline

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.

EPSS (exploitation in 30 days)

0.25% · top 84% of all CVEs (14 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

• Linux · Linux

  • affected 0771dfefc9e538f077d0b43b6dec19a5a67d0e70 – < 6511984d1aa1360181bcafb1ca75df7f291ef237
  • affected 0771dfefc9e538f077d0b43b6dec19a5a67d0e70 – < 4aced32596ead1820b7dbd8e40d30b30dc1f3ad4
  • affected 0771dfefc9e538f077d0b43b6dec19a5a67d0e70 – < 3b4222494489f6d4b8705a496dab03384b7ca998
  • affected 0771dfefc9e538f077d0b43b6dec19a5a67d0e70 – < b524455a51feb6013df3a5dba3160487b2e8e22a
  • affected 0771dfefc9e538f077d0b43b6dec19a5a67d0e70 – < 6b54082c3ed4dc9821cdf0edb17302355cc5bb45

• Linux · Linux

  • affected 2.6.17
  • unaffected < 2.6.17
  • unaffected 6.1.159 – ≤ 6.1.*
  • unaffected 6.6.117 – ≤ 6.6.*
  • unaffected 6.12.58 – ≤ 6.12.*
  • unaffected 6.17.8 – ≤ 6.17.*
  • unaffected 6.18 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-201861 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-40341](https://cveledger.app/badge/CVE-2025-40341.svg)](https://cveledger.app/cve/CVE-2025-40341)

Record last updated 11 May 2026, 21:47 UTC.