7.8
High
CVE-2022-3176 There exists a use-after-free in io_uring in the Linux kernel
Description
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kernel | Versions not published |
References
- kernel.dance kernel.dance
- git.kernel.org git.kernel.org
- DSA-5257 www.debian.org
- [debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update lists.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of kernel
The 97 CVEs of kernel →
CVE-2021-47482
In the Linux kernel, the following vulnerability has been resolved: net: batman-adv: fix error handling Syzbot…
5.3
Medium
CVE-2024-25743
In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and…
7.1
High
CVE-2021-34981
Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability
7.5
High
CVE-2023-52584
In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif…
3.8
Low