CVE-2024-58000

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent reg-wait speculations With ENTEREXTARGREG instead of passing a user pointer with arguments for the waiting loop the user can specify an offset into a pre-mapped region of memory, in which case the offset, offset ...

PT-2025-8787 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically in the io uring component. The issue allowed for reg-wait speculations, which could be exploited by passing a user...

CVE-2022-49144

In the Linux kernel, the following vulnerability has been resolved: iouring: fix memory leak of uid in files registration When there are no files for iosqefilesscm to process in the range, it'll free everything and return. However, it forgets to put uid...

CVE-2022-49056

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2022-49056

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2022-49056

Removed by vendor...

Linux io_uring Use-After-Free Exploit

The Linux kernel suffers from a use-after-free of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without waiting for the required grace period. Summary UAF of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without...

CVE-2022-2327

iouring use workflags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORINGOP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We...

CVE-2025-21655

In the Linux kernel, the following vulnerability has been resolved: iouring/eventfd: ensure ioeventfdsignal defers another RCU period ioeventfddosignal is invoked from an RCU callback, but when dropping the reference to the ioevfd, it calls ioeventfdfree directly if the refcount drops to zero. Th...

CVE-2025-21633

In the Linux kernel, the following vulnerability has been resolved: iouring/sqpoll: zero sqd-thread on tctx errors Syzkeller reports: BUG: KASAN: slab-use-after-free in threadgroupcputime+0x409/0x700 kernel/sched/cputime.c:341 Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552 Call...

CVE-2025-21633

...

CVE-2025-21633

CVE-2025-21633 appears in multiple advisories as part of the Linux kernel fixes: MiracleLinux AXSA:2025-10431:39 for kernel 5.14.0-570.16.1.el9_6 (remote kernel io_uring sqpoll path) and is listed among kernels in Rocky Linux 10, AlmaLinux 9/10, RHEL 9/10/Oracle Linux advisories. The described is...

CVE-2025-21630

In the Linux kernel, the following vulnerability has been resolved: iouring/net: always initialize kmsg-msg.msginq upfront syzbot reports that -msginq may get used uinitialized from the following path: BUG: KMSAN: uninit-value in iorecvbufselect iouring/net.c:1094 inline BUG: KMSAN: uninit-value ...

CVE-2024-56762

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-53187

CVE-2024-53187 affects the Linux kernel io_uring subsystem (io_pin_pages in io_uring/memmap.c). The issue arises from overflow/garbage uaddr handling when deriving size, enabling local attackers to trigger a fault; CVSSv3.1 metrics shown include Local attack, Low complexity, Low privileges, with ...

CVE-2022-48983 io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()

In the Linux kernel, the following vulnerability has been resolved: iouring: Fix a null-ptr-deref in iotctxexitcb Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in iotctxexitcb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm:...

CVE-2024-41080

In the Linux kernel, the following vulnerability has been resolved: iouring: fix possible deadlock in ioregisteriowqmaxworkers The ioregisteriowqmaxworkers function calls ioputsqdata, which acquires the sqd-lock without releasing the uringlock. Similar to the commit 009ad9f0c6ee "iouring: drop...

CVE-2022-48937

CVE-2022-48937 affects the Linux kernel io_uring subsystem, specifically a missing schedule point introduced in io_add_buffers. The vulnerability can cause soft lockups when a loop runs ~65,535 times performing kmalloc allocations, with DEBUG features (e.g., KASAN) enabled amplifying the issue. R...

CVE-2024-42254

In the Linux kernel, the following vulnerability has been resolved: iouring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs ISERR inconsistent error handling in ioallocpbufring. KASAN: null-ptr-deref in range 0x0000000000000000-0x0000000000000007 RIP:...

CVE-2024-39371

In the Linux kernel, the following vulnerability has been resolved: iouring: check for non-NULL file pointer in iofilecanpoll In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that...