CVE-2025-40364: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring: fix ioreqprepasync with provided buffers ioreqprepasync can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed...

Linux kernel io_uring Heap Buffer Overflow DoS

The vulnerability of the iorwinitfile function in the iouring/rw.c module, a component of the Linux kernel’s asynchronous input/output interface, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

io_uring: prevent opcode speculation

...

USN-7413-1: Linux kernel (IoT) vulnerabilities

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. CVE-2022-38096 Ye Zhang and Nicolas Wu discovered th...

USN-7383-2 linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Ublk userspace block driver; -...

Linux io_uring Heap Buffer Overflow DoS

The vulnerability of the ioringbufferselect function in the iouring component of the Linux operating system is related to the dereferencing of a NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux io_uring Kernel Buffer Overflow DoS

The vulnerabilities of the functions iowriteprep and iowrite in the Linux operating system’s iouring/iouring.c kernel are related to improper resource locking. Exploiting these vulnerabilities can allow an attacker to cause service failures...

PT-2025-18408

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the io uring/net component, specifically regarding the abuse of io req post cqe by send bundles. The issue arises because...

io_uring Heap Buffer Overflow DoS

The vulnerability of the ioregisteriowqmaxworkers function in the iouring/iouring.c module, a component of the Linux kernel’s asynchronous input/output interface, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Linux kernel io_uring SQ Buffer Overflow DoS

The vulnerability of the iosqthread function in the iouring/sqpoll.c module, a component of the Linux kernel’s asynchronous input/output interface, is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux kernel io_uring Buffer Overflow DoS

The vulnerability of the ioclonebuffers function in the iouring/rsrc.c module of the Linux kernel’s asynchronous input/output interface is related to improper validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

Linux 6.4 io_uring Use-After-Free

iouring in Linux 6.4 suffers from a iouring page use-after-free condition via buffer ring mmap. Since commit c56e022c0a27 "iouring: add support for user mapped provided buffer ring", landed in Linux 6.4, iouring makes it possible to allocate, mmap, and deallocate "buffer rings". A "buffer ring" c...

Linux io_uring Out-Of-Bounds Access

iouaddrmap in iouring handles multi-page region dangerously in a way that may allow for out-of-bounds access. iouaddrmap wants to import a region from userspace, and then address the imported region through the linear mapping area. This requires that the imported region is physically contiguous. ...

Linux 5.6 Cred Refcount Overflow

Linux 5.6 suffers from a cred refcount overflow at approximately 39 gigs of memory usage via iouring. see also my related prior bug reports about overflowing refcounts with lots of RAM usage: https://crbug.com/project-zero/809: BPF program refcount, with 32GiB RAM...

SUSE CVE-2025-21863

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

AZL-58547 CVE-2025-21863 affecting package kernel for versions less than 6.6.82.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

AZL-58563 CVE-2025-21863 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

DEBIAN-CVE-2025-21863

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

CVE-2025-21863

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

UBUNTU-CVE-2025-21863

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...