CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
In the Linux kernel, the following vulnerability has been resolved:
iouring/eventfd: ensure ioeventfdsignal() defers another RCU period
ioeventfddosignal() is invoked from an RCU callback, but when dropping the reference to the ioevfd, it calls ioeventfdfree() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the ioevfd should be deferred another RCU grace period.
Just call ioeventfdput() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21655?
CVE-2025-21655 has been rated as having a low severity due to its specific nature and limited impact.
How do I fix CVE-2025-21655?
To fix CVE-2025-21655, update your Linux kernel to the latest stable version where this vulnerability is addressed.
What systems are affected by CVE-2025-21655?
CVE-2025-21655 affects the Linux kernel across various distributions that utilize the io_uring subsystem.
Is CVE-2025-21655 being actively exploited?
As of the latest information, there have been no reports indicating active exploitation of CVE-2025-21655.
What does CVE-2025-21655 involve technically?
CVE-2025-21655 involves a potential issue where io_eventfd_signal() lacks proper RCU period deferral leading to improper resource management.