CVE-2025-40267

Root

Cause

The vulnerability resides in the Linux kernel's io_uring subsystem, specifically in the read/write (rw) path. A previous commit introduced recycling infrastructure for early cleanup of iovec allocations. However, when the internal iovec caches overflow, the allocated iovec is not properly freed if the request is aborted early. This leads to a memory leak or potential use-after-free condition [1].

Exploitation

An attacker would need to trigger a scenario where io_uring requests are submitted and then aborted early, while also causing the internal iovec caches to overflow. This requires local access to the system and the ability to create io_uring instances. The attack surface is limited to users with sufficient privileges to use io_uring, but no special network position is required [1].

Impact

Successful exploitation could lead to memory corruption or information disclosure, as the leaked iovec may contain kernel memory pointers. In worst-case scenarios, this could be leveraged for privilege escalation or denial of service. The exact impact depends on system configuration and memory layout [1].

Mitigation

The fix reinstates the previous forced free of the iovec for the overflow case, ensuring proper cleanup. The patch is included in stable kernel updates. Users should apply the latest kernel updates from their distribution to remediate this vulnerability [1].