Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2021-47123

io_uring: fix ltout double free on completion race

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix ltout double free on completion race Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 90cd7e424969d29aff653333b4dcb4e2e199d791 to < 1f64f5e903b9d1d157875721e02adadc9d6f0a5daffected
  • 90cd7e424969d29aff653333b4dcb4e2e199d791 to < 447c19f3b5074409c794b350b10306e1da1ef4baaffected

Linux Linux

Default version status: affected

  • 5.11affected
  • 0 to < 5.11unaffected
  • 5.12.10 to ≤ 5.12.*unaffected
  • 5.13 to ≤ *unaffected

References