huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-38022: kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

Call Trace:

 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 strlen+0x93/0xa0 lib/string.c:420
 __fortify_strlen include/linux/fortify-string.h:268 [inline]
 get_kobj_path_length lib/kobject.c:118 [inline]
 kobject_get_path+0x3f/0x2a0 lib/kobject.c:158
 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
 ib_register_device drivers/infiniband/core/device.c:1472 [inline]
 ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393
 rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550
 rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225
 nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796
 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195
 rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
 __sys_sendmsg+0x16d/0x220 net/socket.c:2652
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

This problem is similar to the problem that the
commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name")
fixes.

The root cause is: the function ib_device_rename() renames the name with
lock. But in the function kobject_uevent(), this name is accessed without
lock protection at the same time.

The solution is to add the lock protection when this name is accessed in
the function kobject_uevent().

Statement: This is a Moderate flaw, a use-after-free was found in the Linux kernel's RDMA core, specifically in the handling of device name renaming due to a race problem. This vulnerability could lead to a system crash or potential information disclosure. Red Hat Enterprise Linux 8, 9, and 10 are affected by this issue.

Affected upstream versions: 5.10.4 < 5.10.248, 5.4.86 < 5.5, 5.11
Fixed upstream versions: 0, 5.10.248, 5.15.198, 5.5, 6.1.160, 6.12.30, 6.14.8, 6.15, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba467b6870ea2a73590478d9612d6ea1dcdd68b7
CVE-2025-38024: kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the `rxe` component. This use-after-free vulnerability occurs in the `rxe_create_cq` function. When the `rxe_cq_from_init` function fails, the subsequent call to `rxe_cleanup` attempts to free memory resources that have already been released, leading to memory corruption. A local attacker with high privileges could exploit this flaw to cause a denial of service or potentially achieve arbitrary code execution.

Statement: Moderate: A use-after-free leading to a kernel information leak issue was seen in the Linux kernel's RDMA `rxe` component, which allows a local attacker with special group privilege to cause a denial of service. This flaw affects Red Hat Enterprise Linux 7, 8, and 9.

Affected upstream versions: 4.8
Fixed upstream versions: 0, 5.10.238, 5.15.184, 5.4.294, 6.1.140, 6.12.30, 6.14.8, 6.15, 6.6.92
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7c7c80c32e00665234e373ab03fe82f5c5c2c230
CVE-2025-38051: kernel: smb: client: Fix use-after-free in cifs_fill_dirent
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A use-after-free flaw was found in cifs_fill_dirent in fs/cifs/readdir.c in smb client in the Linux Kernel. This flaw could allow an attacker to crash the system due to race problem. This vulnerability could even lead to a kernel information leak problem.

Statement: This Moderate impact flaw in the Linux kernel's SMB client (CIFS) can lead to a system crash or information disclosure due to a race problem, leading to a use-after-free vulnerability during directory operations. Red Hat Enterprise Linux 8, 9, and 10 are affected when utilizing the CIFS client functionality.

Affected upstream versions: 2.6.27.4 < 2.6.28, 2.6.28
Fixed upstream versions: 0, 2.6.28, 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: aee067e88d61eb72e966f094e4749c6b14e7008f
CVE-2025-38052: kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

A vulnerability was found in the Linux kernel's management of network namespaces. By manipulating the lifecycle of network namespaces, an attacker could exploit this vulnerability to cause a system crash or leak sensitive system memory. Exploitation of this vulnerability requires that a user has access to the system and the ability to create or destroy network namespaces. This typically requires administrative privileges, but could be exposed to an unprivileged user who has control over container lifecycles or a user who has administrative privileges within a container.

Statement: A slab-use-after-free vulnerability exists in the TIPC crypto subsystem in the Linux kernel. The bug is triggered when a network namespace is deleted while an asynchronous crypto operation is still pending, resulting in access to freed memory from a delayed worker context. The vulnerability requires local privileges to create and manipulate network namespaces and configure TIPC crypto bearers, which justifies the use of PR:L. Despite this, the impact on system memory and stability is significant due to the asynchronous nature of the cryptographic operation. Although not directly reachable from an unprivileged user context, this issue can be exploited by a local attacker with limited privileges, for example, in a container, to crash the kernel or perform arbitrary memory access via crafted namespace lifecycle manipulation.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.238, 5.15.185, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d42ed4de6aba232d946d20653a70f79158a6535b
CVE-2025-38053: kernel: idpf: fix null-ptr-deref in idpf_features_check
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the idpf module in the Linux kernel. A null pointer dereference can be triggered when the driver attempts to use a resource that has already been released, resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.10 and 9.4 via RHSA-2025:9580 [1] and RHSA-2024:2394 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2025:9580

[2]. https://access.redhat.com/errata/RHSA-2024:2394

Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.12.31, 6.14.9, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6f5e9c8cb680c3cb9771fd9fa114319cbc4f514
CVE-2025-38067: kernel: rseq: Fix segfault on registration when rseq_cs is non-zero
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rseq: Fix segfault on registration when rseq_cs is non-zero

The rseq_cs field is documented as being set to 0 by user-space prior to
registration, however this is not currently enforced by the kernel. This
can result in a segfault on return to user-space if the value stored in
the rseq_cs field doesn't point to a valid struct rseq_cs.

The correct solution to this would be to fail the rseq registration when
the rseq_cs field is non-zero. However, some older versions of glibc
will reuse the rseq area of previous threads without clearing the
rseq_cs field and will also terminate the process if the rseq
registration fails in a secondary thread. This wasn't caught in testing
because in this case the leftover rseq_cs does point to a valid struct
rseq_cs.

What we can do is clear the rseq_cs field on registration when it's
non-zero which will prevent segfaults on registration and won't break
the glibc versions that reuse rseq areas on thread creation.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.240, 5.15.189, 6.1.146, 6.12.39, 6.14.9, 6.15, 6.6.99
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 48900d839a3454050fd5822e34be8d54c4ec9b86
CVE-2025-38075: kernel: Linux kernel: Denial of Service due to NULL pointer dereference in iSCSI target NOPIN timer handling
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

A flaw was found in the Linux kernel. The iSCSI (Internet Small Computer System Interface) target subsystem, which manages network-based storage connections, contains a vulnerability where a NOPIN response timer can improperly expire and restart on a deleted connection. This can lead to a NULL pointer dereference, a programming error that causes the system to crash. A local attacker could exploit this to cause a denial of service (DoS) on the affected system.


Affected upstream versions: 3.1
Fixed upstream versions: 0, 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 571ce6b6f5cbaf7d24af03cad592fc0e2a54de35
CVE-2025-38079: kernel: crypto: algif_hash - fix double free in hash_accept
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_hash - fix double free in hash_accept

If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.


Affected upstream versions: 2.6.38
Fixed upstream versions: 0, 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5bff312b59b3f2a54ff504e4f4e47272b64f3633
CVE-2025-38084: kernel: mm/hugetlb: unshare page tables during VMA split, not before
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-06-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: unshare page tables during VMA split, not before

Currently, __split_vma() triggers hugetlb page table unsharing through
vm_ops->may_split().  This happens before the VMA lock and rmap locks are
taken - which is too early, it allows racing VMA-locked page faults in our
process and racing rmap walks from other processes to cause page tables to
be shared again before we actually perform the split.

Fix it by explicitly calling into the hugetlb unshare logic from
__split_vma() in the same place where THP splitting also happens.  At that
point, both the VMA and the rmap(s) are write-locked.

An annoying detail is that we can now call into the helper
hugetlb_unshare_pmds() from two different locking contexts:

1. from hugetlb_split(), holding:
    - mmap lock (exclusively)
    - VMA lock
    - file rmap lock (exclusively)
2. hugetlb_unshare_all_pmds(), which I think is designed to be able to
   call us with only the mmap lock held (in shared mode), but currently
   only runs while holding mmap lock (exclusively) and VMA lock

Backporting note:
This commit fixes a racy protection that was introduced in commit
b30c14cd6102 ("hugetlb: unshare some PMDs when splitting VMAs"); that
commit claimed to fix an issue introduced in 5.13, but it should actually
also go all the way back.

[jannh@google.com: v2]


Affected upstream versions: 2.6.20
Fixed upstream versions: 0, 5.10.239, 5.15.186, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e8847d18cd9fff1edbb45e963d9141273c3b539c
CVE-2025-38085: kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-06-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

huge_pmd_unshare() drops a reference on a page table that may have
previously been shared across processes, potentially turning it into a
normal page table used in another process in which unrelated VMAs can
afterwards be installed.

If this happens in the middle of a concurrent gup_fast(), gup_fast() could
end up walking the page tables of another process.  While I don't see any
way in which that immediately leads to kernel memory corruption, it is
really weird and unexpected.

Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),
just like we do in khugepaged when removing page tables for a THP
collapse.


Affected upstream versions: 2.6.20
Fixed upstream versions: 0, 5.10.239, 5.15.186, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 952596b08c74e8fe9e2883d1dc8a8f54a37384ec
CVE-2025-38086: kernel: net: ch9200: fix uninitialised access during mii_nway_restart
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ch9200: fix uninitialised access during mii_nway_restart

In mii_nway_restart() the code attempts to call
mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read()
utilises a local buffer called "buff", which is initialised
with control_read(). However "buff" is conditionally
initialised inside control_read():

        if (err == size) {
                memcpy(data, buf, size);
        }

If the condition of "err == size" is not met, then
"buff" remains uninitialised. Once this happens the
uninitialised "buff" is accessed and returned during
ch9200_mdio_read():

        return (buff[0] | buff[1] << 8);

The problem stems from the fact that ch9200_mdio_read()
ignores the return value of control_read(), leading to
uinit-access of "buff".

To fix this we should check the return value of
control_read() and return early on error.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 119766de4930ff40db9f36b960cb53b0c400e81b
CVE-2025-38087: kernel: net/sched: fix use-after-free in taprio_dev_notifier
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in taprio_dev_notifier

Since taprio’s taprio_dev_notifier() isn’t protected by an
RCU read-side critical section, a race with advance_sched()
can lead to a use-after-free.

Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.

Statement: A race condition in taprio_dev_notifier() could lead to a use-after-free (UAF) when it accesses q->oper_sched or q->admin_sched outside of an RCU read-side critical section. This could be exploited by triggering concurrent updates to the taprio scheduler (e.g., via traffic control tools). The issue is resolved by wrapping the relevant accesses in rcu_read_lock()/rcu_read_unlock() and switching from rtnl_dereference() to rcu_dereference(). While the exploitability is low (requires root or CAP_NET_ADMIN), this is a clear use-after-free that can potentially compromise kernel memory. Therefore, CIA: HHH. The Privileges for the CVSS could be Low or High depending on what are the default permissions in the system (basically speaking if user has access to the qdisc, then can trigger it, but by default user would not have such access in Red Hat Enterprise Linux that limits this vulnarability impact level to Moderate).
The CVSS base score is approximately:
6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) in systems where access to traffic control is restricted (like Red Hat Enterprise Linux).
7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) if unprivileged users are allowed to manipulate qdiscs.
The related Kernel config param CONFIG_NET_SCH_TAPRIO enabled only for the latest versions of the Red Hat Enterprise Linux 9 and disabled for the Red Hat Enterprise Linux 8 and before.

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8c5713ce1ced75f9e9ed5c642ea3d2ba06ead69c
CVE-2025-38088: kernel: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-30T00:00:00+00:00

A denial-of-service vulnerability has been identified in the Linux kernel, stemming from an out-of-bounds overflow. This flaw occurs when the requested memory mapping region size exceeds the allocated region size. An attacker can exploit this by crafting a specially designed file, which, when processed by the kernel, could trigger an overflow. This leads to a system crash, impacting the availability of the affected system.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.186, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 81260c41b518b6f32c701425f1427562fa92f293
CVE-2025-38089: kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
Component: kernel
Severity: Important
CWE: CWE-754 (Improper Check for Unusual or Exceptional Conditions)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-06-30T00:00:00+00:00

A flaw was found in the Linux kernel, where a specially crafted RPC packet could cause data corruption or trigger a system panic. This flaw allows a remote attacker who can make RPC calls to send an intentionally malformed packet, potentially compromising system integrity or causing a denial of service (DoS).

Statement: This vulnerability is caused by incorrect error handling in the Linux kernel's RPC code. When a malformed packet is sent during RPC authentication, the kernel does not correctly set an authorization status field pointer to a sensible value. When that pointer is later dereferenced, an affected system might either crash due to a NULL pointer dereference, or garbage data might be written to another memory address, impacting system integrity.

Affected upstream versions: 6.3.4 < 6.4, 6.4
Fixed upstream versions: 0, 6.12.35, 6.15.4, 6.16, 6.4, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 599c489eea793821232a2f69a00fa57d82b0ac98
CVE-2025-38097: kernel: espintcp: remove encap socket caching to avoid reference leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

espintcp: remove encap socket caching to avoid reference leak

The current scheme for caching the encap socket can lead to reference
leaks when we try to delete the netns.

The reference chain is: xfrm_state -> enacp_sk -> netns

Since the encap socket is a userspace socket, it holds a reference on
the netns. If we delete the espintcp state (through flush or
individual delete) before removing the netns, the reference on the
socket is dropped and the netns is correctly deleted. Otherwise, the
netns may not be reachable anymore (if all processes within the ns
have terminated), so we cannot delete the xfrm state to drop its
reference on the socket.

This patch results in a small (~2% in my tests) performance
regression.

A GC-type mechanism could be added for the socket cache, to clear
references if the state hasn't been used "recently", but it's a lot
more complex than just not caching the socket.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4cde54b46a87231c77256a633be1bef62687d69
CVE-2025-38106: kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's io_uring subsystem. A local attacker with low privileges could exploit a use-after-free vulnerability when the `sq->thread` object is prematurely released while still being accessed by the `__io_uring_show_fdinfo()` function. This flaw could lead to privilege escalation, allowing the attacker to execute arbitrary code, disclose sensitive information, or cause a system-wide denial of service.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: af8c13f9ee040b9a287ba246cf0055f7c77b7cc8