CVE-2025-40201

In the Linux kernel, the following vulnerability has been resolved:

kernel/sys.c: fix the racy usage of tasklock(tsk->groupleader) in sys_prlimit64() paths

The usage of tasklock(tsk->groupleader) in sysprlimit64()->doprlimit() path is very broken.

sysprlimit64() does gettaskstruct(tsk) but this only protects taskstruct itself. If tsk != current and tsk is not a leader, this process can exit/exec and tasklock(tsk->groupleader) may use the already freed task_struct.

Another problem is that sysprlimit64() can race with mt-exec which changes ->groupleader. In this case doprlimit() may take the wrong lock, or (worse) ->groupleader may change between tasklock() and taskunlock().

Change sysprlimit64() to take tasklistlock when necessary. This is not nice, but I don't see a better fix for -stable.