CVE-2025-1290

Published Apr 17, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure
during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

ChromeOS

affected

Version	Status	Constraints
`15474.84.0`	affected	< 15474.84.0

Configuration 1 [-]

AND

cpe:2.3:o:google:chrome_os:15474.84.0:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:5.4:-:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-11484	A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.276% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://issues.chromium.org/issues/b/301886931
https://issuetracker.google.com/issues/301886931

History

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00058}`	epss `{'score': 0.00062}`

Jul 12, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0005}`	epss `{'score': 0.00058}`

Jul 11, 2025 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome Os Linux Linux linux Kernel
CPEs		cpe:2.3:o:google:chrome_os:15474.84.0:::::::* cpe:2.3:o:linux:linux_kernel:5.4:-::::::
Vendors & Products		Google Google chrome Os Linux Linux linux Kernel

Apr 17, 2025 2:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 17, 2025 1:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall can occur before a worker thread accesses it, resulting in a dangling pointer and potential kernel code execution.	A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.

Apr 17, 2025 12:30 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall can occur before a worker thread accesses it, resulting in a dangling pointer and potential kernel code execution.
References		https://issues.chromium.org/issues/b/301886931 https://issuetracker.google.com/issues/301886931