In the Linux kernel, the following vulnerability has been resolved:
io_uring/rsrc: fix folio unpinning
syzbot complains about an unmapping failure:
[ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7d0 (P) [ 108.178138][ T14] unpin_user_page+0x80/0x10c [ 108.180189][ T14] io_release_ubuf+0x84/0xf8 [ 108.182196][ T14] io_free_rsrc_node+0x250/0x57c [ 108.184345][ T14] io_rsrc_data_free+0x148/0x298 [ 108.186493][ T14] io_sqe_buffers_unregister+0x84/0xa0 [ 108.188991][ T14] io_ring_ctx_free+0x48/0x480 [ 108.191057][ T14] io_ring_exit_work+0x764/0x7d8 [ 108.193207][ T14] process_one_work+0x7e8/0x155c [ 108.195431][ T14] worker_thread+0x958/0xed8 [ 108.197561][ T14] kthread+0x5fc/0x75c [ 108.199362][ T14] ret_from_fork+0x10/0x20
We can pin a tail page of a folio, but then io_uring will try to unpin the head page of the folio. While it should be fine in terms of keeping the page actually alive, mm folks say it's wrong and triggers a debug warning. Use unpin_user_folio() instead of unpin_user_page*.
[axboe: adapt to current tree, massage commit message]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.12Upgrade bpftool6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-toolsUpgrade kernel-livepatch-6.12.37-61.105Upgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade python3-perf6.12Upgrade perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade perf6.12 | Sep 9, 2025 | Jul 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade dtb-marvellUpgrade kernel-64kb-extraUpgrade kernel-default-livepatchUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-64kbUpgrade kernel-64kbUpgrade dtb-hisiliconUpgrade ocfs2-kmp-rtUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-azureUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade kernel-obs-qaUpgrade dtb-renesasUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade kernel-docsUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade dlm-kmp-defaultUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dtb-amlogicUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-defaultUpgrade kernel-symsUpgrade kernel-develUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade gfs2-kmp-rtUpgrade kernel-source-vanillaUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade gfs2-kmp-defaultUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade kernel-64kb-develUpgrade dtb-armUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade dtb-xilinxUpgrade dtb-caviumUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade kernel-azure-develUpgrade kselftests-kmp-64kb | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-aws-64k-6.14Upgrade linux-image-azureUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-azure-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1014-oemUpgrade linux-image-aws-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1015-awsUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-generic-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-virtual-6.14Upgrade linux-image-generic-64kUpgrade linux-image-azure-nvidia-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-aws-64kUpgrade linux-image-oem-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-realtimeUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-azure-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-oem-24.04bUpgrade linux-image-oem-24.04c | Jul 14, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub