Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38106— io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于io_uring在__io_uring_show_fdinfo中使用后释放sq->thread。

CVSS 7.8 · High EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1003 · OS Credential Dumping

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 3fcb9d17206e31630f802a3ab52081d1342b8ed9< af8c13f9ee040b9a287ba246cf0055f7c77b7cc8 affected
3fcb9d17206e31630f802a3ab52081d1342b8ed9< d0932758a0a77b38ba1b39564f3b7aba12407061 affected
3fcb9d17206e31630f802a3ab52081d1342b8ed9< ac0b8b327a5677dc6fecdf353d808161525b1ff0 affected
6.9 affected
< 6.9 unaffected
6.12.34≤ 6.12.* unaffected
6.15.3≤ 6.15.* unaffected
6.16≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38106

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x670 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? getrusage+0x1109/0x1a60 kasan_report+0xce/0x100 ? getrusage+0x1109/0x1a60 getrusage+0x1109/0x1a60 ? __pfx_getrusage+0x10/0x10 __io_uring_show_fdinfo+0x9fe/0x1790 ? ksys_read+0xf7/0x1c0 ? do_syscall_64+0xa4/0x260 ? vsnprintf+0x591/0x1100 ? __pfx___io_uring_show_fdinfo+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 ? mutex_trylock+0xcf/0x130 ? __pfx_mutex_trylock+0x10/0x10 ? __pfx_show_fd_locks+0x10/0x10 ? io_uring_show_fdinfo+0x57/0x80 io_uring_show_fdinfo+0x57/0x80 seq_show+0x38c/0x690 seq_read_iter+0x3f7/0x1180 ? inode_set_ctime_current+0x160/0x4b0 seq_read+0x271/0x3e0 ? __pfx_seq_read+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? __mark_inode_dirty+0x402/0x810 ? selinux_file_permission+0x368/0x500 ? file_update_time+0x10f/0x160 vfs_read+0x177/0xa40 ? __pfx___handle_mm_fault+0x10/0x10 ? __pfx_vfs_read+0x10/0x10 ? mutex_lock+0x81/0xe0 ? __pfx_mutex_lock+0x10/0x10 ? fdget_pos+0x24d/0x4b0 ksys_read+0xf7/0x1c0 ? __pfx_ksys_read+0x10/0x10 ? do_user_addr_fault+0x43b/0x9c0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0f74170fc9 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 8 RSP: 002b:00007fffece049e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0f74170fc9 RDX: 0000000000001000 RSI: 00007fffece049f0 RDI: 0000000000000004 RBP: 00007fffece05ad0 R08: 0000000000000000 R09: 00007fffece04d90 R10: 0000000000000000 R11: 0000000000000206 R12: 00005651720a1100 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 298: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_node_noprof+0xe8/0x330 copy_process+0x376/0x5e00 create_io_thread+0xab/0xf0 io_sq_offload_create+0x9ed/0xf20 io_uring_setup+0x12b0/0x1cc0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 22: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0xc4/0x360 rcu_core+0x5ff/0x19f0 handle_softirqs+0x18c/0x530 run_ksoftirqd+0x20/0x30 smpboot_thread_fn+0x287/0x6c0 kthread+0x30d/0x630 ret_from_fork+0xef/0x1a0 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x33/0x60 kasan_record_aux_stack+0x8c/0xa0 __call_rcu_common.constprop.0+0x68/0x940 __schedule+0xff2/0x2930 __cond_resched+0x4c/0x80 mutex_lock+0x5c/0xe0 io_uring_del_tctx_node+0xe1/0x2b0 io_uring_clean_tctx+0xb7/0x160 io_uring_cancel_generic+0x34e/0x760 do_exit+0x240/0x2350 do_group_exit+0xab/0x220 __x64_sys_exit_group+0x39/0x40 x64_sys_call+0x1243/0x1840 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88810de2cb00 which belongs to the cache task_struct of size 3712 The buggy address is located 1992 bytes inside of freed 3712-byte region [ffff88810de2cb00, ffff88810de2d980) which is caused by the task_struct pointed to by sq->thread being released while it is being used in the function __io_uring_show_fdinfo(). Holding ctx->uring_lock does not prevent ehre relase or exit of sq->thread. Fix this by assigning and looking up ->thread under RCU, and grabbing a reference to the task_struct. This e ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于io_uring在__io_uring_show_fdinfo中使用后释放sq->thread。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3fcb9d17206e31630f802a3ab52081d1342b8ed9 ~ af8c13f9ee040b9a287ba246cf0055f7c77b7cc8 -
Linux Linux 6.9 -

II. Public POCs for CVE-2025-38106

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38106

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-03 · 78 CVEs total

CVE-2025-38123 9.8 CRITICAL net: wwan: t7xx: Fix napi rx poll issue
CVE-2025-38139 9.8 CRITICAL netfs: Fix oops in write-retry from mis-resetting the subreq iterator
CVE-2025-38120 9.4 CRITICAL netfilter: nf_set_pipapo_avx2: fix initial map fill
CVE-2025-38146 9.4 CRITICAL net: openvswitch: Fix the dead loop of MPLS parse
CVE-2025-38116 7.8 HIGH wifi: ath12k: fix uaf in ath12k_core_init()
CVE-2025-38168 7.8 HIGH perf: arm-ni: Unregister PMUs on probe failure
CVE-2025-38097 7.8 HIGH espintcp: remove encap socket caching to avoid reference leak
CVE-2025-38154 7.8 HIGH bpf, sockmap: Avoid using sk_socket after free when sending
CVE-2025-38107 7.8 HIGH net_sched: ets: fix a race in ets_qdisc_change()
CVE-2025-38150 7.8 HIGH af_packet: move notifier's packet_dev_mc out of rcu critical section
CVE-2025-38110 7.8 HIGH net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
CVE-2025-38111 7.8 HIGH net/mdiobus: Fix potential out-of-bounds read/write access
CVE-2025-38141 7.8 HIGH dm: fix dm_blk_report_zones
CVE-2025-38108 7.8 HIGH net_sched: red: fix a race in __red_change()
CVE-2025-38115 7.8 HIGH net_sched: sch_sfq: fix a potential crash on gso_skb handling
CVE-2025-38117 7.8 HIGH Bluetooth: MGMT: Protect mgmt_pending list with its own lock
CVE-2025-38118 7.8 HIGH Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
CVE-2025-38133 7.8 HIGH iio: adc: ad4851: fix ad4858 chan pointer handling
CVE-2025-38129 7.8 HIGH page_pool: Fix use-after-free in page_pool_recycle_in_ring
CVE-2025-38127 7.8 HIGH ice: fix Tx scheduler error handling in XDP callback

Showing top 20 of 78 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38106

No comments yet

Leave a comment