There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.144-127.601Upgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-toolsUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf | Oct 14, 2022 | Sep 16, 2022 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.10-15.42Upgrade kernelUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-debuginfo-common-aarch64 | Feb 17, 2025 | Sep 1, 2022 |
| Debian | — | Upgrade linux | Nov 1, 2022 | Sep 16, 2022 |
| Suse | — | Upgrade dtb-apmUpgrade kernel-debugUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-default-base-rebuildUpgrade kernel-devel-rtUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade dtb-mediatekUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade reiserfs-kmp-preemptUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade kernel-preemptUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade kernel-zfcpdumpUpgrade dtb-broadcomUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade dtb-amazonUpgrade kselftests-kmp-defaultUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade cluster-md-kmp-azureUpgrade dtb-armUpgrade kernel-devel-azureUpgrade dtb-freescaleUpgrade ocfs2-kmp-preemptUpgrade dtb-zteUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade dtb-alUpgrade gfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-preemptUpgrade kernel-rt_debugUpgrade kernel-preempt-extraUpgrade kernel-develUpgrade dtb-marvellUpgrade dtb-rockchipUpgrade kernel-docs-htmlUpgrade dtb-alteraUpgrade reiserfs-kmp-64kbUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-preempt-optionalUpgrade dtb-nvidiaUpgrade kselftests-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade dtb-caviumUpgrade dtb-appleUpgrade kernel-docsUpgrade kernel-preempt-develUpgrade kernel-default-optionalUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-preemptUpgrade kernel-rt_debug-develUpgrade kernel-debug-develUpgrade kernel-source-vanillaUpgrade kernel-preempt-livepatch-develUpgrade dtb-amdUpgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-xilinxUpgrade dlm-kmp-preemptUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kselftests-kmp-preemptUpgrade dtb-allwinner | Nov 9, 2022 | Sep 16, 2022 |
| Ubuntu | — | Upgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-lpae-hwe-22.04Upgrade linux-image-5.4.0-1054-gkeopUpgrade linux-image-5.15.0-1016-raspi-nolpaeUpgrade linux-image-5.15.0-1017-intel-iotgUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-50-generic-lpaeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1015-ibmUpgrade linux-image-5.15.0-1019-oracleUpgrade linux-image-5.15.0-1016-raspiUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1019-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1084-gkeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1090-gcpUpgrade linux-image-gke-5.4Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-1021-awsUpgrade linux-image-kvmUpgrade linux-image-5.15.0-50-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-oem-osp1Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1086-awsUpgrade linux-image-5.15.0-50-lowlatency-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-50-generic-64kUpgrade linux-image-genericUpgrade linux-image-5.4.0-128-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1047-bluefieldUpgrade linux-image-azure-fdeUpgrade linux-image-5.4.0-1071-raspiUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-5.4.0-1092-azure-fdeUpgrade linux-image-5.4.0-1034-ibmUpgrade linux-image-5.4.0-128-generic-lpaeUpgrade linux-image-oemUpgrade linux-image-bluefieldUpgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1021-azureUpgrade linux-image-5.15.0-50-genericUpgrade linux-image-5.4.0-128-genericUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1019-kvmUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1004-gkeopUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-1076-kvmUpgrade linux-image-gke-5.15Upgrade linux-image-oracleUpgrade linux-image-5.15.0-1017-gkeUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-1084-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-22.04 | Oct 11, 2022 | Sep 16, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub