In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
{
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29582.json",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "5.17.3"
}
],
"source": "DESCRIPTION"
}
]
}
]
}{
"extracted_events": [
{
"range": [
{
"fixed": "e677edbcabee849bfdd43f1602bccbecf736a646"
}
],
"source": "REFERENCES_COMMIT"
}
]
}