In the Linux kernel, the following vulnerability has been resolved:
io_uring/rsrc: fix folio unpinning
syzbot complains about an unmapping failure:
[ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7d0 (P) [ 108.178138][ T14] unpin_user_page+0x80/0x10c [ 108.180189][ T14] io_release_ubuf+0x84/0xf8 [ 108.182196][ T14] io_free_rsrc_node+0x250/0x57c [ 108.184345][ T14] io_rsrc_data_free+0x148/0x298 [ 108.186493][ T14] io_sqe_buffers_unregister+0x84/0xa0 [ 108.188991][ T14] io_ring_ctx_free+0x48/0x480 [ 108.191057][ T14] io_ring_exit_work+0x764/0x7d8 [ 108.193207][ T14] process_one_work+0x7e8/0x155c [ 108.195431][ T14] worker_thread+0x958/0xed8 [ 108.197561][ T14] kthread+0x5fc/0x75c [ 108.199362][ T14] ret_from_fork+0x10/0x20
We can pin a tail page of a folio, but then io_uring will try to unpin the head page of the folio. While it should be fine in terms of keeping the page actually alive, mm folks say it's wrong and triggers a debug warning. Use unpin_user_folio() instead of unpin_user_page*.
[axboe: adapt to current tree, massage commit message]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-headersUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftool6.12Upgrade kernel6.12-tools-develUpgrade kernel-livepatch-6.12.37-61.105Upgrade python3-perf6.12Upgrade bpftool6.12-debuginfoUpgrade kernel6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade perf6.12-debuginfoUpgrade kernel6.12-tools | Sep 9, 2025 | Jul 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kernel-default-optionalUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade kernel-64kb-develUpgrade dtb-lgUpgrade kernel-default-vdsoUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade dtb-mediatekUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-azure-develUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-sourceUpgrade dtb-caviumUpgrade dtb-xilinxUpgrade kernel-devel-azureUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-default-baseUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade kernel-default-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-default-extraUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-azureUpgrade dtb-appleUpgrade kernel-docsUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-defaultUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade dtb-renesasUpgrade kernel-macrosUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade dlm-kmp-rtUpgrade kernel-rt-optionalUpgrade dlm-kmp-default | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-azureUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1014-oemUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-gcp-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-6.14.0-1015-awsUpgrade linux-image-genericUpgrade linux-image-virtual-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-generic-64k-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-gcpUpgrade linux-image-azure-6.14Upgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-oem-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-nvidia-6.14Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-raspi-6.14 | Jul 14, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub