CVE-2025-40216
io_uring/rsrc: don't rely on user vaddr alignment
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.36, 6.15.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of it.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From a8edbb424b1391b077407c75d8f5d2ede77aa70d · fixed in 50998b0ae7d9d552e96d8b7239981cf05f65eff5; From a8edbb424b1391b077407c75d8f5d2ede77aa70d · fixed in f16769241594be59387b56ab525e327f54377e60; From a8edbb424b1391b077407c75d8f5d2ede77aa70d · fixed in 3a3c6d61577dbb23c09df3e21f6f9eda1ecd634b
- Linux Linux
6.12
- KernelLinux
From 6.12.0 · fixed in 6.12.36; From 6.13.0 · fixed in 6.15.5