In the Linux kernel, the following vulnerability has been resolved:
io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()
Not everything requires locking in there, which is why the 'has_lock'
variable exists. But enough does that it's a bit unwieldy to manage.
Wrap the whole thing in a ->uring_lock trylock, and just return
with no output if we fail to grab it. The existing trylock() will
already have greatly diminished utility/output for the failure case.
This fixes an issue with reading the SQE fields, if the ring is being
actively resized at the same time.
References
| Link | Resource |
|---|---|
| https://git.kernel.org/stable/c/bdb7d2ec2e31c46c45d1f32667dfa8216a72705e | Patch |
| https://git.kernel.org/stable/c/d871198ee431d90f5308d53998c1ba1d5db5619a | Patch |
| https://project-zero.issues.chromium.org/issues/417522668 | Exploit Issue Tracking |
Configurations
Configuration 1 (hide)
|
History
14 Nov 2025, 16:47
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/bdb7d2ec2e31c46c45d1f32667dfa8216a72705e - Patch | |
| References | () https://git.kernel.org/stable/c/d871198ee431d90f5308d53998c1ba1d5db5619a - Patch | |
| References | () https://project-zero.issues.chromium.org/issues/417522668 - Exploit, Issue Tracking |
Information
Published : 2025-06-06 14:15
Updated : 2025-11-14 16:47
NVD link : CVE-2025-38002
Mitre link : CVE-2025-38002
CVE.ORG link : CVE-2025-38002
JSON object : View
Products Affected
linux
- linux_kernel
CWE