The Linux kernel had a vulnerability in the memory management swap code where VMA readahead could cause a use-after-free (UAF) condition. This occurred because since commit 78524b05f1a3, the helper function __read_swap_cache_async stopped internally acquiring swap device references, assuming callers already held them. However, VMA readahead walks page tables and may encounter swap entries from multiple devices, calling __read_swap_cache_async on devices without holding references. This race condition between swapoff on one device and swapin on another could lead to UAF. The fix ensures VMA readahead obtains device references when accessing swap entries from devices different than the target entry's device.

Successful exploitation could result in use-after-free conditions in kernel memory management, potentially leading to arbitrary code execution, kernel crashes, or data corruption. The CVSS vector indicates local attack vector with low complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel repositories and vendor advisories for patches addressing CVE-2025-40270. Apply updates promptly once available to mitigate the risk. No specific temporary mitigations are indicated in the provided data.