In the Linux kernel, the following vulnerability has been resolved:
io_uring/rsrc: fix folio unpinning
syzbot complains about an unmapping failure:
[ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7d0 (P) [ 108.178138][ T14] unpin_user_page+0x80/0x10c [ 108.180189][ T14] io_release_ubuf+0x84/0xf8 [ 108.182196][ T14] io_free_rsrc_node+0x250/0x57c [ 108.184345][ T14] io_rsrc_data_free+0x148/0x298 [ 108.186493][ T14] io_sqe_buffers_unregister+0x84/0xa0 [ 108.188991][ T14] io_ring_ctx_free+0x48/0x480 [ 108.191057][ T14] io_ring_exit_work+0x764/0x7d8 [ 108.193207][ T14] process_one_work+0x7e8/0x155c [ 108.195431][ T14] worker_thread+0x958/0xed8 [ 108.197561][ T14] kthread+0x5fc/0x75c [ 108.199362][ T14] ret_from_fork+0x10/0x20
We can pin a tail page of a folio, but then io_uring will try to unpin the head page of the folio. While it should be fine in terms of keeping the page actually alive, mm folks say it's wrong and triggers a debug warning. Use unpin_user_folio() instead of unpin_user_page*.
[axboe: adapt to current tree, massage commit message]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.12-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.37-61.105Upgrade python3-perf6.12Upgrade bpftool6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12Upgrade kernel6.12-libbpfUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-develUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-headersUpgrade perf6.12 | Sep 9, 2025 | Jul 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kernel-devel-azureUpgrade dtb-mediatekUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-rt-develUpgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade kernel-syms-azureUpgrade dtb-xilinxUpgrade kernel-azure-develUpgrade kernel-kvmsmallUpgrade dtb-nvidiaUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade dtb-armUpgrade dtb-rockchipUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-qcomUpgrade kernel-rtUpgrade dtb-exynosUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade dtb-renesasUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade dtb-amazonUpgrade ocfs2-kmp-rtUpgrade dtb-sprdUpgrade dtb-amdUpgrade kernel-obs-qaUpgrade kernel-64kb-extraUpgrade kernel-64kbUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade dtb-freescaleUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-default-develUpgrade kernel-azureUpgrade dtb-appleUpgrade kselftests-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-default-livepatchUpgrade kernel-docs-html | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-gcpUpgrade linux-image-oem-24.04bUpgrade linux-image-virtualUpgrade linux-image-awsUpgrade linux-image-oracle-6.14Upgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-generic-64k-6.14Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-6.14.0-1014-oemUpgrade linux-image-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-aws-64k-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-6.14.0-1015-awsUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-nvidia-6.14Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-genericUpgrade linux-image-virtual-6.14Upgrade linux-image-realtime-6.14 | Jul 14, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub