CVE-2025-21836

CVE-2025-21836

High · published March 7, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

io_uring/kbuf: reallocate buf lists on upgrade

IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it

was created for legacy selected buffer and has been emptied. It violates

the requirement that most of the field should stay stable after publish.

Always reallocate it instead.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.7th percentile
Published
2025-03-07T14:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 5.19, < 6.6.796.6.79
linux/linux_kernel≥ 6.7, < 6.12.166.12.16
linux/linux_kernel≥ 6.13, < 6.13.46.13.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/146a185f6c05ee263db715f860620606303c4633 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2a5febbef40ce968e295a7aeaa5d5cbd9e3e5ad4 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d0dc28dae836caf7645fef62a10befc624dd17b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://u1f383.github.io/slides/talks/2025_Hexacon-Deja_Vu_in_Linux_io_uring_Breaking_Memory_Sharing_Again_After_Generations_of_Fixes.pdf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 07 MAR 09:09Z
    io_uring/kbuf: reallocate buf lists on upgrade
    cvelistv5