SB2025050850 - Race condition within a thread in Linux kernel io_uring
Published: May 8, 2025 Updated: May 10, 2025
Security Bulletin ID
SB2025050850
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition within a thread (CVE-ID: CVE-2025-37804)
The vulnerability allows a local user to corrupt data.
The vulnerability exists due to a data race within the io_wq_free_work() function in io_uring/io_uring.c. A local user can corrupt data.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/3568fd9e440ea393c7d8bee253419ea11fd8e9d9
- https://git.kernel.org/stable/c/390513642ee6763c7ada07f0a1470474986e6c1c
- https://git.kernel.org/stable/c/6d2753b46452a557a12f7ef1ef4ee6641b4e89d8
- https://git.kernel.org/stable/c/c5d4d103005d8926cdad344f9fc947e651c9f2f7
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.89