CVE-2025-38002: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved:
iouring/fdinfo: grab ctx->uringlock around iouringshowfdinfo()
Not everything requires locking in there, which is why the 'haslock' variable exists. But enough does that it's a bit unwieldy to manage. Wrap the whole thing in a ->uringlock trylock, and just return with no output if we fail to grab it. The existing trylock() will already have greatly diminished utility/output for the failure case.
This fixes an issue with reading the SQE fields, if the ring is being actively resized at the same time.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38002?
CVE-2025-38002 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38002?
To fix CVE-2025-38002, you should update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38002?
CVE-2025-38002 affects specific versions of the Linux kernel.
What type of vulnerability is CVE-2025-38002?
CVE-2025-38002 is related to locking mechanisms in io_uring functionality within the Linux kernel.
Is there a workaround for CVE-2025-38002?
There is no well-known workaround for CVE-2025-38002; applying the patch is the recommended solution.