In the Linux kernel, the following vulnerability has been resolved:
io_uring: check for non-NULL file pointer in io_file_can_poll()
In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that looks as follows:
BUG: kernel NULL pointer dereference, address: 00000000000000b0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022 RIP: 0010:io_buffer_select+0xc3/0x210 Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246 RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700 RBP: 0000000000000000 R08: 0000000000200030 R09: 0000000000000020 R10: ffffb7bec38c7dc8 R11: 000000000000c000 R12: ffffb7bec38c7db8 R13: ffff97aecfb05800 R14: ffff97aecfb05800 R15: ffff97af2be5e000 FS: 00007f852f74b740(0000) GS:ffff97b1eeec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000b0 CR3: 000000016deab005 CR4: 0000000000370ef0 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x14d/0x420 ? do_user_addr_fault+0x61/0x6a0 ? exc_page_fault+0x6c/0x150 ? asm_exc_page_fault+0x22/0x30 ? io_buffer_select+0xc3/0x210 __io_import_iovec+0xb5/0x120 io_readv_prep_async+0x36/0x70 io_queue_sqe_fallback+0x20/0x260 io_submit_sqes+0x314/0x630 __do_sys_io_uring_enter+0x339/0xbc0 ? __do_sys_io_uring_register+0x11b/0xc50 ? vm_mmap_pgoff+0xce/0x160 do_syscall_64+0x5f/0x180 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x55e0a110a67e Code: ba cc 00 00 00 45 31 c0 44 0f b6 92 d0 00 00 00 31 d2 41 b9 08 00 00 00 41 83 e2 01 41 c1 e2 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 90 89 30 eb a9 0f 1f 40 00 48 8b 42 20 8b 00 a8 06 75 af 85 f6
because the request is marked forced ASYNC and has a bad file fd, and hence takes the forced async prep path.
Current kernels with the request async prep cleaned up can no longer hit this issue, but for ease of backporting, let's add this safety check in here too as it really doesn't hurt. For both cases, this will inevitably end with a CQE posted with -EBADF.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-livepatch-6.1.96-102.177Upgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Jun 11, 2025 | Jun 25, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 18, 2024 | Jun 25, 2024 |
| Suse | — | Upgrade dtb-qcomUpgrade kernel-obs-buildUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-debug-livepatch-develUpgrade kernel-devel-azureUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-azure-livepatch-develUpgrade dtb-nvidiaUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade kernel-source-azureUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade dtb-exynosUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade cluster-md-kmp-rtUpgrade dtb-amdUpgrade kernel-64kb-develUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade kernel-develUpgrade kernel-docsUpgrade kernel-rt_debugUpgrade kernel-rt-livepatchUpgrade kernel-symsUpgrade kernel-devel-rtUpgrade kernel-defaultUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-freescaleUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debugUpgrade kernel-azure-extraUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade dtb-appleUpgrade dtb-sprdUpgrade dtb-marvellUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade dtb-amazonUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade dtb-renesas | Jul 23, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-ibmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-virtualUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-azureUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-lowlatency | Sep 12, 2024 | Jun 25, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub