CVE-2025-21633: io_uring/sqpoll: zero sqd->thread on tctx errors
In the Linux kernel, the following vulnerability has been resolved:
iouring/sqpoll: zero sqd->thread on tctx errors
Syzkeller reports:
BUG: KASAN: slab-use-after-free in threadgroupcputime+0x409/0x700 kernel/sched/cputime.c:341 Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552 Call Trace: <TASK> ... kasanreport+0x143/0x180 mm/kasan/report.c:602 threadgroupcputime+0x409/0x700 kernel/sched/cputime.c:341 threadgroupcputimeadjusted+0xa6/0x340 kernel/sched/cputime.c:639 getrusage+0x1000/0x1340 kernel/sys.c:1863 iouringshowfdinfo+0xdfe/0x1770 iouring/fdinfo.c:197 seqshow+0x608/0x770 fs/proc/fd.c:68 ...
That's due to sqd->task not being cleared properly in cases where SQPOLL task tctx setup fails, which can essentially only happen with fault injection to insert allocation errors.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21633?
CVE-2025-21633 has been classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21633?
To fix CVE-2025-21633, update your Linux kernel to the latest stable version that includes the patch.
What systems are affected by CVE-2025-21633?
CVE-2025-21633 affects various versions of the Linux kernel utilized across multiple Linux distributions.
What type of vulnerability is CVE-2025-21633?
CVE-2025-21633 is categorized as a memory management issue leading to a use-after-free condition in the Linux kernel.
Is there any known exploit for CVE-2025-21633?
As of now, there are no public exploits specifically targeting CVE-2025-21633 reported.