CVE-2025-21836
io_uring/kbuf: reallocate buf lists on upgrade
MEDIUM 5.5EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved:io_uring/kbuf: reallocate buf lists on upgradeIORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if itwas created for legacy selected buffer and has been emptied. It violatesthe requirement that most of the field should stay stable after publish.Always reallocate it instead.
- Affected
- Linux
- CVSS v3.1 NVD
- 5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1 CNA
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.25% chance of exploitation in the next 30 days, 16th percentile
- Published
- 2025-03-07
- Updated
- 2026-10-15
Exploit collections (1)
- linux/kernelctf/CVE-2025-21836_ltsgoogle/security-research
Security advisories
- https://git.kernel.org/stable/c/146a185f6c05ee263db715f860620606303c4633
- https://git.kernel.org/stable/c/2a5febbef40ce968e295a7aeaa5d5cbd9e3e5ad4
- https://git.kernel.org/stable/c/7d0dc28dae836caf7645fef62a10befc624dd17b
- https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603