CVE-2025-38002

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38002", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.977Z", "datePublished": "2025-06-06T13:43:41.137Z", "dateUpdated": "2026-08-05T11:58:53.483Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:53.483Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()\n\nNot everything requires locking in there, which is why the 'has_lock'\nvariable exists. But enough does that it's a bit unwieldy to manage.\nWrap the whole thing in a ->uring_lock trylock, and just return\nwith no output if we fail to grab it. The existing trylock() will\nalready have greatly diminished utility/output for the failure case.\n\nThis fixes an issue with reading the SQE fields, if the ring is being\nactively resized at the same time."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached purely through local syscalls \u2014 `io_uring_setup()`/`io_uring_register(IORING_REGISTER_RESIZE_RINGS)` plus a `read()` of `/proc/self/fdinfo/<ring fd>`. No remote or adjacent-network data is processed anywhere along the path.\nAC:L - The attacker controls both sides of the race, spinning one thread on resize and another on fdinfo reads, and can widen the window arbitrarily by using a large old ring and a small new ring so the unlocked SQE/CQE dump loop runs for thousands of iterations. No condition outside the attacker's influence is required.\nPR:L - Any unprivileged local user can create an io_uring instance with `IORING_SETUP_DEFER_TASKRUN|SINGLE_ISSUER` and resize it; no capability check exists on the register path. Reading one's own `/proc/self/fdinfo/<fd>` always satisfies the `ptrace_may_access(PTRACE_MODE_READ_FSCREDS)` gate in `proc_fdinfo_permission()`.\nUI:N - The entire attack runs inside the attacker's own process using its own ring fd and its own procfs entries. No other user or administrator has to do anything.\nS:U - The stale-pointer reads, faults, and information disclosure all occur in kernel context against the attacking process's own kernel objects, within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Stale `ctx->rings`/`ctx->sq_array` pointers are dereferenced after `release_pages()`/`vunmap()` frees the old ring regions, and stale `sq_entries`/`sq_mask` combined with the new smaller `ctx->sq_sqes` yield an out-of-bounds read of up to ~2 MB past the SQE region at an offset the attacker chooses through the userspace-mapped `sq_array`. The recovered bytes (`opcode, fd, flags, off, addr, rw_flags, buf_index, user_data`, or a full 128 bytes with SQE128) are `seq_printf()`ed directly into the fdinfo output the attacker reads, giving a repeatable kernel-memory disclosure primitive.\nI:H - This is a use-after-free on freed ring pages that can be recycled into arbitrary kernel allocations and then heap-sprayed by the attacker to steer the derived out-of-bounds dereference, consistent with UAF scoring practice for this subsystem. The leaked heap contents and kernel pointers also defeat KASLR and directly enable control-flow-hijacking exploitation of adjacent kernel state.\nA:H - `ctx->rings` and `ctx->sq_sqes` are transiently NULL during the swap, so `READ_ONCE(r->sq.head)` and `&ctx->sq_sqes[sq_idx << sq_shift]` produce a NULL-pointer oops, and dereferencing a `vunmap()`'d old region or reading megabytes past the new SQE region faults the kernel. An unprivileged user can trigger these in a tight loop for a reliable panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/fdinfo.c"], "versions": [{"version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972", "lessThan": "bdb7d2ec2e31c46c45d1f32667dfa8216a72705e", "status": "affected", "versionType": "git"}, {"version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972", "lessThan": "d871198ee431d90f5308d53998c1ba1d5db5619a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/fdinfo.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.8", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.14.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bdb7d2ec2e31c46c45d1f32667dfa8216a72705e"}, {"url": "https://git.kernel.org/stable/c/d871198ee431d90f5308d53998c1ba1d5db5619a"}, {"url": "https://project-zero.issues.chromium.org/issues/417522668"}], "title": "io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/fdinfo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bdb7d2ec2e31c46c45d1f32667dfa8216a72705e", "status": "affected", "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972", "versionType": "git"}, {"lessThan": "d871198ee431d90f5308d53998c1ba1d5db5619a", "status": "affected", "version": "79cfe9e59c2a12c3b3faeeefe38d23f3d8030972", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/fdinfo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4458049-AD51-4F1B-BAB9-C32B53A54DE1", "versionEndExcluding": "6.14.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()\n\nNot everything requires locking in there, which is why the 'has_lock'\nvariable exists. But enough does that it's a bit unwieldy to manage.\nWrap the whole thing in a ->uring_lock trylock, and just return\nwith no output if we fail to grab it. The existing trylock() will\nalready have greatly diminished utility/output for the failure case.\n\nThis fixes an issue with reading the SQE fields, if the ring is being\nactively resized at the same time."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/fdinfo: captura ctx-&gt;uring_lock en torno a io_uring_show_fdinfo(). No todo requiere bloqueo, raz\u00f3n por la cual existe la variable 'has_lock'. Sin embargo, suficientes requieren bloqueo como para que sea un poco dif\u00edcil de manejar. Envuelva todo en un trylock `-&gt;uring_lock` y simplemente devuelva sin salida si no logramos capturarlo. El trylock() existente ya tendr\u00e1 una utilidad/salida considerablemente reducida en caso de fallo. Esto soluciona un problema con la lectura de los campos SQE si el anillo se est\u00e1 redimensionando activamente al mismo tiempo."}], "id": "CVE-2025-38002", "lastModified": "2026-07-30T06:22:43.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-06T14:15:22.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bdb7d2ec2e31c46c45d1f32667dfa8216a72705e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d871198ee431d90f5308d53998c1ba1d5db5619a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Exploit", "Issue Tracking"], "url": "https://project-zero.issues.chromium.org/issues/417522668"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()", "id": "2370723", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370723"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nio_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()\nNot everything requires locking in there, which is why the 'has_lock'\nvariable exists. But enough does that it's a bit unwieldy to manage.\nWrap the whole thing in a ->uring_lock trylock, and just return\nwith no output if we fail to grab it. The existing trylock() will\nalready have greatly diminished utility/output for the failure case.\nThis fixes an issue with reading the SQE fields, if the ring is being\nactively resized at the same time."], "name": "CVE-2025-38002", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38002\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38002\nhttps://lore.kernel.org/linux-cve-announce/2025060644-CVE-2025-38002-5e89@gregkh/T"], "statement": "This patch resolves a race condition in io_uring_show_fdinfo() that could lead to inconsistent or partially updated data being read from /proc/<pid>/fdinfo/<fd> when the ring was being concurrently resized. The race was caused by accessing shared context fields without always holding uring_lock. The fix ensures the function only proceeds if it can safely acquire the mutex. This mitigates potential information leaks or instability during concurrent io_uring activity and fdinfo inspection. The vulnerability is only exploitable by processes with high privileges, as it requires access to io_uring resources, use of IORING_REGISTER_RESIZE_RINGS, and the ability to read from /proc/<pid>/fdinfo/<fd>, all of which are typically restricted to privileged users or the process owner.", "threat_severity": "Moderate"}

{"created": "2025-06-24T09:51:41.847521+00:00", "updated": "2025-06-24T09:51:41.847583+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}