CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
First published: Mon Jan 20 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev_fd should be deferred another RCU grace period. Just call io_eventfd_put() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/6b63308c28987c6010b1180c72a6db4df6c68033
- https://git.kernel.org/stable/c/8efff2aa2d95dc437ab67c5b4a9f1d3f367baa10
- https://git.kernel.org/stable/c/a7085c3ae43b86d4b3d1b8275e6a67f14257e3b7
- https://git.kernel.org/stable/c/c9a40292a44e78f71258b8522655bffaf5753bdb
- https://project-zero.issues.chromium.org/issues/388499293
Frequently Asked Questions
What is the severity of CVE-2025-21655?
CVE-2025-21655 has been rated as having a low severity due to its specific nature and limited impact.
How do I fix CVE-2025-21655?
To fix CVE-2025-21655, update your Linux kernel to the latest stable version where this vulnerability is addressed.
What systems are affected by CVE-2025-21655?
CVE-2025-21655 affects the Linux kernel across various distributions that utilize the io_uring subsystem.
Is CVE-2025-21655 being actively exploited?
As of the latest information, there have been no reports indicating active exploitation of CVE-2025-21655.
What does CVE-2025-21655 involve technically?
CVE-2025-21655 involves a potential issue where io_eventfd_signal() lacks proper RCU period deferral leading to improper resource management.
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/last-modified-date
- agent/author
- agent/event
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- vendor/linux
- canonical/linux kernel