In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
syzbot reports:
BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304
CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x670 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? getrusage+0x1109/0x1a60 kasan_report+0xce/0x100 ? getrusage+0x1109/0x1a60 getrusage+0x1109/0x1a60 ? __pfx_getrusage+0x10/0x10 __io_uring_show_fdinfo+0x9fe/0x1790 ? ksys_read+0xf7/0x1c0 ? do_syscall_64+0xa4/0x260 ? vsnprintf+0x591/0x1100 ? __pfx___io_uring_show_fdinfo+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 ? mutex_trylock+0xcf/0x130 ? __pfx_mutex_trylock+0x10/0x10 ? __pfx_show_fd_locks+0x10/0x10 ? io_uring_show_fdinfo+0x57/0x80 io_uring_show_fdinfo+0x57/0x80 seq_show+0x38c/0x690 seq_read_iter+0x3f7/0x1180 ? inode_set_ctime_current+0x160/0x4b0 seq_read+0x271/0x3e0 ? __pfx_seq_read+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? __mark_inode_dirty+0x402/0x810 ? selinux_file_permission+0x368/0x500 ? file_update_time+0x10f/0x160 vfs_read+0x177/0xa40 ? __pfx___handle_mm_fault+0x10/0x10 ? __pfx_vfs_read+0x10/0x10 ? mutex_lock+0x81/0xe0 ? __pfx_mutex_lock+0x10/0x10 ? fdget_pos+0x24d/0x4b0 ksys_read+0xf7/0x1c0 ? __pfx_ksys_read+0x10/0x10 ? do_user_addr_fault+0x43b/0x9c0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0f74170fc9 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 8 RSP: 002b:00007fffece049e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0f74170fc9 RDX: 0000000000001000 RSI: 00007fffece049f0 RDI: 0000000000000004 RBP: 00007fffece05ad0 R08: 0000000000000000 R09: 00007fffece04d90 R10: 0000000000000000 R11: 0000000000000206 R12: 00005651720a1100 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>
Allocated by task 298: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_node_noprof+0xe8/0x330 copy_process+0x376/0x5e00 create_io_thread+0xab/0xf0 io_sq_offload_create+0x9ed/0xf20 io_uring_setup+0x12b0/0x1cc0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0xc4/0x360 rcu_core+0x5ff/0x19f0 handle_softirqs+0x18c/0x530 run_ksoftirqd+0x20/0x30 smpboot_thread_fn+0x287/0x6c0 kthread+0x30d/0x630 ret_from_fork+0xef/0x1a0 ret_from_fork_asm+0x1a/0x30
Last potentially related work creation: kasan_save_stack+0x33/0x60 kasan_record_aux_stack+0x8c/0xa0 __call_rcu_common.constprop.0+0x68/0x940 __schedule+0xff2/0x2930 __cond_resched+0x4c/0x80 mutex_lock+0x5c/0xe0 io_uring_del_tctx_node+0xe1/0x2b0 io_uring_clean_tctx+0xb7/0x160 io_uring_cancel_generic+0x34e/0x760 do_exit+0x240/0x2350 do_group_exit+0xab/0x220 __x64_sys_exit_group+0x39/0x40 x64_sys_call+0x1243/0x1840 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88810de2cb00 which belongs to the cache task_struct of size 3712 The buggy address is located 1992 bytes inside of freed 3712-byte region [ffff88810de2cb00, ffff88810de2d980)
which is caused by the task_struct pointed to by sq->thread being released while it is being used in the function __io_uring_show_fdinfo(). Holding ctx->uring_lock does not prevent ehre relase or exit of sq->thread.
Fix this by assigning and looking up ->thread under RCU, and grabbing a reference to the task_struct. This e ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernelUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-64kUpgrade kernel-64k-coreUpgrade kernel-rt-develUpgrade kernel-rt-64k-debug-develUpgrade python3-perfUpgrade kernel-64k-modules-coreUpgrade kernel-debugUpgrade kernel-rt-64k-debugUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-modules-extraUpgrade rtlaUpgrade kernel-tools-libsUpgrade kernel-64k-modulesUpgrade kernel-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-64k-develUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-docUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64kUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-modules-extraUpgrade rvUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade kernel-coreUpgrade kernel-rt | Mar 12, 2026 | Mar 9, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel6.12Upgrade kernel-libbpf-debuginfoUpgrade bpftoolUpgrade kernel-modules-extra-commonUpgrade perf6.12Upgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade kernel-develUpgrade perf6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel-tools-debuginfo | Aug 5, 2025 | Jul 3, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Mar 12, 2026 | Jul 3, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Jul 3, 2025 |
| Suse | — | Upgrade dtb-amazonUpgrade kernel-devel-azureUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade kernel-rt-livepatchUpgrade dtb-alteraUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade kernel-rt-extraUpgrade dtb-caviumUpgrade dtb-qcomUpgrade kernel-source-azureUpgrade kernel-syms-azureUpgrade gfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade ocfs2-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-sprdUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade kernel-develUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade kernel-default-baseUpgrade dtb-mediatekUpgrade dtb-apmUpgrade kernel-symsUpgrade dtb-renesasUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kernel-docsUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade dtb-amdUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade kernel-rt-vdsoUpgrade kernel-default-extraUpgrade dtb-arm | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-realtime-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-gcp-64kUpgrade linux-image-aws-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-genericUpgrade linux-image-gcp-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-aws-64kUpgrade linux-image-oem-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-virtualUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-24.04cUpgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-aws-64k-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-gcpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-awsUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-oracle-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-generic-64kUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04a | Jul 7, 2025 | Jul 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub