2693 matches found
CVE-2023-52926 io_uring/rw: split io_read() into a helper
In the Linux kernel, the following vulnerability has been resolved: IORINGOPREAD did not correctly consume the provided buffer list when read i/o returned 0 except for -EAGAIN and -EIOCBQUEUED return. This can lead to a potential use-after-free when the completion via iorwdone runs at separate...
Linux io_uring Use-After-Free Exploit
The Linux kernel suffers from a use-after-free of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without waiting for the required grace period. Summary UAF of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without...
Linux io_uring Use-After-Free
The Linux kernel suffers from a use-after-free of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without waiting for the required grace period. Summary UAF of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without...
Linux kernel io_uring DoS
The vulnerability of the iouring component in the Linux operating system’s kernel is related to incorrect blocking of resources in the iotctxexitcb function. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE CVE-2023-2236
A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Both ioinstallfixedfile and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend...
SUSE CVE-2023-3389
A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Racing a iouring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59...
PT-2025-11025
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to io uring. The issue involves preventing opcode speculation, where sqe-opcode is used for different tables and needs to...
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2025-21682: eth: bnxt: always recalculate features after XDP clearing, fix null-deref bsc1236703. CVE-2025-21678: gtp: Destroy device along with udp socket's netns...
Ubuntu: Security Advisory (USN-7234-4)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-7234-4 linux-aws vulnerabilities
Ye Zhang and Nicolas Wu discovered that the iouring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...
USN-7234-4: Linux kernel (AWS) vulnerabilities
Ye Zhang and Nicolas Wu discovered that the iouring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: iouring: Check whether we need to reschedule during overflow flushing. In terms of normal application usage, this list will always be empty. If an application does cause an overflow, it will have a few entries in this list...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: iouring/sqpoll: a workaround for a potential audit memory leak kmemleak reports a memory leak related to handling connect calls: Unreferenced object 0xffff0001093bdf00 size 128: Command "iou-sqp-455", PID 457, jiffies 42948941...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: iouring: check for non-NULL file pointer in iofilecanpoll In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: iouring: A potential deadlock has been fixed in ioregisteriowqmaxworkers. The ioregisteriowqmaxworkers function calls ioputsqdata, which acquires the sqd-lock without releasing the uringlock. Similar to the commit 009ad9f0c6ee...
CVE-2025-21686
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-21686
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-21686
The initial CVE-2025-21686 entry is marked as rejected, but connected sources describe a real Linux kernel issue related to io_uring: when cloning buffers between uring instances A and B that use different memory accounting contexts, closing A before B can decrement B’s pinned memory counters, po...
Astra Linux - уязвимость в linux-5.10
In the Linux kernel, the following vulnerability has been resolved: iouring/kbuf: hold iobufferlist reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safely use the iouring lock. Rely on the fact...