Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
194bb58c6090e39bd7d9b9c888a079213628e1f6 to < d9f93172820a53ab42c4b0e5e65291f4f9d00ad2affected194bb58c6090e39bd7d9b9c888a079213628e1f6 to < d34c04152df517c59979b4bf2a47f491e06d3256affected194bb58c6090e39bd7d9b9c888a079213628e1f6 to < 508c1314b342b78591f51c4b5dadee31a88335dfaffected
Linux Linux
Default version status: affected
6.7affected0 to < 6.7unaffected6.12.44 to ≤ 6.12.*unaffected6.16.4 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected