CVE-2025-38453

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38453
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38453.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38453
Downstream
Related
Published
2025-07-25T15:27:33Z
Modified
2025-10-18T04:12:52.503189Z
Summary
io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
Details

In the Linux kernel, the following vulnerability has been resolved:

iouring/msgring: ensure io_kiocb freeing is deferred for RCU

syzbot reports that defer/local taskwork adding via msgring can hit a request that has been freed:

CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dumpstacklvl+0x189/0x250 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xd2/0x2b0 mm/kasan/report.c:521 kasanreport+0x118/0x150 mm/kasan/report.c:634 ioreqlocalworkadd iouring/iouring.c:1184 [inline] _ioreqtaskworkadd+0x589/0x950 iouring/iouring.c:1252 iomsgremotepost iouring/msgring.c:103 [inline] iomsgdataremote iouring/msgring.c:133 [inline] _iomsgringdata+0x820/0xaa0 iouring/msgring.c:151 iomsgringdata iouring/msgring.c:173 [inline] iomsgring+0x134/0xa00 iouring/msgring.c:314 _ioissuesqe+0x17e/0x4b0 iouring/iouring.c:1739 ioissuesqe+0x165/0xfd0 iouring/iouring.c:1762 iowqsubmitwork+0x6e9/0xb90 iouring/iouring.c:1874 ioworkerhandlework+0x7cd/0x1180 iouring/io-wq.c:642 iowqworker+0x42f/0xeb0 iouring/io-wq.c:696 retfromfork+0x3fc/0x770 arch/x86/kernel/process.c:148 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 </TASK>

which is supposed to be safe with how requests are allocated. But msg ring requests alloc and free on their own, and hence must defer freeing to a sane time.

Add an rcuhead and use kfreercu() in both spots where requests are freed. Only the one in iomsgtw_complete() is strictly required as it has been visible on the other ring, but use it consistently in the other spot as well.

This should not cause any other issues outside of KASAN rightfully complaining about it.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0617bb500bfabf8447062f1e1edde92ed2b638f1
Fixed
094ba14a471cc6c68078c7ad488539eaf32c2277
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0617bb500bfabf8447062f1e1edde92ed2b638f1
Fixed
e5b3432f4a6b418b8bd8fc91f38efbf17a77167a
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0617bb500bfabf8447062f1e1edde92ed2b638f1
Fixed
fc582cd26e888b0652bc1494f252329453fd3b23

Affected versions

v6.*

v6.10
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.39
v6.12.4
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.15.1
v6.15.2
v6.15.3
v6.15.4
v6.15.5
v6.15.6

Database specific

vanir_signatures

[
    {
        "digest": {
            "function_hash": "14570797603056128408574440477530341775",
            "length": 494.0
        },
        "id": "CVE-2025-38453-13303a3c",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_remote_post",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "319060586089046108137431258542339012528",
            "length": 389.0
        },
        "id": "CVE-2025-38453-1ed8a2d5",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_tw_complete",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "316104968895194139292457174220261499033",
                "167937798402195900985511770655329417544",
                "246461007798997619907561741185211043822",
                "142592817201479063261118651952530309519"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-2974d266",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc582cd26e888b0652bc1494f252329453fd3b23",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "include/linux/io_uring_types.h"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "function_hash": "77099159195832847354828702212527832445",
            "length": 511.0
        },
        "id": "CVE-2025-38453-45fbd03b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@094ba14a471cc6c68078c7ad488539eaf32c2277",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_remote_post",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "41886127388736172806167609448420388797",
            "length": 391.0
        },
        "id": "CVE-2025-38453-4d3d5208",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@094ba14a471cc6c68078c7ad488539eaf32c2277",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_tw_complete",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "201107205309502667601981114083840026368",
                "170713019119671852467431839845250310241",
                "229717964521977955804920183449712526928",
                "267375942798292577135067300834509659702"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-73779533",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@094ba14a471cc6c68078c7ad488539eaf32c2277",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "include/linux/io_uring_types.h"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "117136151070532726947550458716534565884",
                "14535625065217669219675175262282339228",
                "86722266875625767314095523738778676717",
                "15401414508035189274202323456998513131",
                "310743349991664041704385470914299858960",
                "133614383624763274060537860593516897281",
                "69066899587212125636020335201689773484",
                "222769325490847030489540353008769593941"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-81f8c7e5",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@094ba14a471cc6c68078c7ad488539eaf32c2277",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "function_hash": "14570797603056128408574440477530341775",
            "length": 494.0
        },
        "id": "CVE-2025-38453-92816a02",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc582cd26e888b0652bc1494f252329453fd3b23",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_remote_post",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "319060586089046108137431258542339012528",
            "length": 389.0
        },
        "id": "CVE-2025-38453-b356ed9e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc582cd26e888b0652bc1494f252329453fd3b23",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "io_msg_tw_complete",
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "316104968895194139292457174220261499033",
                "167937798402195900985511770655329417544",
                "246461007798997619907561741185211043822",
                "142592817201479063261118651952530309519"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-f4f7e14a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "include/linux/io_uring_types.h"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "117136151070532726947550458716534565884",
                "14535625065217669219675175262282339228",
                "86722266875625767314095523738778676717",
                "15401414508035189274202323456998513131",
                "90912159210829926760370409835288770618",
                "171854338950709669924473202925260154087",
                "134536690571065618791535401320710478543",
                "222769325490847030489540353008769593941"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-fe978eb1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b3432f4a6b418b8bd8fc91f38efbf17a77167a",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "line_hashes": [
                "117136151070532726947550458716534565884",
                "14535625065217669219675175262282339228",
                "86722266875625767314095523738778676717",
                "15401414508035189274202323456998513131",
                "90912159210829926760370409835288770618",
                "171854338950709669924473202925260154087",
                "134536690571065618791535401320710478543",
                "222769325490847030489540353008769593941"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-38453-ffbb48a5",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc582cd26e888b0652bc1494f252329453fd3b23",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "io_uring/msg_ring.c"
        },
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.12.46
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.7