In the Linux kernel, the following vulnerability has been resolved:
io_uring/rsrc: fix folio unpinning
syzbot complains about an unmapping failure:
[ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7d0 (P) [ 108.178138][ T14] unpin_user_page+0x80/0x10c [ 108.180189][ T14] io_release_ubuf+0x84/0xf8 [ 108.182196][ T14] io_free_rsrc_node+0x250/0x57c [ 108.184345][ T14] io_rsrc_data_free+0x148/0x298 [ 108.186493][ T14] io_sqe_buffers_unregister+0x84/0xa0 [ 108.188991][ T14] io_ring_ctx_free+0x48/0x480 [ 108.191057][ T14] io_ring_exit_work+0x764/0x7d8 [ 108.193207][ T14] process_one_work+0x7e8/0x155c [ 108.195431][ T14] worker_thread+0x958/0xed8 [ 108.197561][ T14] kthread+0x5fc/0x75c [ 108.199362][ T14] ret_from_fork+0x10/0x20
We can pin a tail page of a folio, but then io_uring will try to unpin the head page of the folio. While it should be fine in terms of keeping the page actually alive, mm folks say it's wrong and triggers a debug warning. Use unpin_user_folio() instead of unpin_user_page*.
[axboe: adapt to current tree, massage commit message]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-headersUpgrade kernel6.12-modules-extra-commonUpgrade perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-develUpgrade kernel6.12-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade kernel6.12-libbpfUpgrade kernel-livepatch-6.12.37-61.105Upgrade bpftool6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-tools | Sep 9, 2025 | Jul 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade dtb-qcomUpgrade kernel-devel-azureUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade dtb-exynosUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade dtb-lgUpgrade dtb-rockchipUpgrade dtb-armUpgrade kernel-64kb-develUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade kernel-source-vanillaUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade dtb-mediatekUpgrade kernel-zfcpdumpUpgrade dtb-xilinxUpgrade kernel-azure-develUpgrade gfs2-kmp-rtUpgrade kernel-rt-develUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-azureUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade cluster-md-kmp-defaultUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade gfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade dtb-sprdUpgrade dtb-renesasUpgrade kernel-macrosUpgrade dtb-appleUpgrade kernel-default-develUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade kernel-64kb-optional | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-1014-oemUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-generic-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-virtual-6.14Upgrade linux-image-genericUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-nvidia-6.14Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1015-awsUpgrade linux-image-aws-6.14Upgrade linux-image-azure-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-realtimeUpgrade linux-image-oracle-6.14Upgrade linux-image-oracleUpgrade linux-image-aws-64kUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-oem-24.04b | Jul 14, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub