CVE-2025-40061 is a race condition vulnerability in the Linux kernel's RDMA/rxe driver. When do_task() exhausts its iteration budget, it sets the task state to TASK_STATE_IDLE without verifying if the task is currently in TASK_STATE_DRAINING, which can be set by concurrent calls to rxe_cleanup_task() or rxe_disable_task(). Although state changes are protected by a spinlock, these cleanup functions release the lock while waiting for the task to drain, creating a race window. If do_task() reacquires the lock during this window, it may incorrectly reschedule the task, leading to a use-after-free scenario. The vulnerability was introduced during a migration from tasklets to workqueues, losing special handling for draining tasks. The fix reinstates the original behavior by forcing a continuation loop iteration when the state is TASK_STATE_DRAINING, ensuring the task finishes draining and transitions to TASK_STATE_DRAINED properly.

Successful exploitation can lead to a use-after-free condition in the Linux kernel's RDMA/rxe driver, potentially allowing an attacker with local privileges to cause memory corruption. This can result in system instability, denial of service, or escalation of privileges due to the high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

A fix for this vulnerability has been implemented in the Linux kernel by restoring the original pre-migration behavior in the do_task() function. Users should apply the official kernel updates that include this fix once available. Since no explicit patch links or vendor advisories are provided, check the Linux kernel vendor advisories or distribution security updates for the official patch and apply it promptly.