CVE-2025-40061

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix race in do_task() when draining

When do_task() exhausts its iteration budget (!ret), it sets the state

to TASK_STATE_IDLE to reschedule, without a secondary check on the

current task->state. This can overwrite the TASK_STATE_DRAINING state

set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().

While state changes are protected by a spinlock, both rxe_cleanup_task()

and rxe_disable_task() release the lock while waiting for the task to

finish draining in the while(!is_done(task)) loop. The race occurs if

do_task() hits its iteration limit and acquires the lock in this window.

The cleanup logic may then proceed while the task incorrectly

reschedules itself, leading to a potential use-after-free.

This bug was introduced during the migration from tasklets to workqueues,

where the special handling for the draining case was lost.

Fix this by restoring the original pre-migration behavior. If t

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References