CVE-2025-71149
- Source
- https://cve.org/CVERecord?id=CVE-2025-71149
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-71149.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-71149
- Downstream
- Related
- Published
- 2026-01-23T14:15:15.878Z
- Modified
- 2026-05-05T16:30:05.497992Z
- Summary
- io_uring/poll: correctly handle io_poll_add() return value on update
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iouring/poll: correctly handle iopoll_add() return value on update
When the core of iouring was updated to handle completions consistently and with fixed return codes, the POLLREMOVE opcode with updates got slightly broken. If a POLLADD is pending and then POLLREMOVE is used to update the events of that request, if that update causes the POLL_ADD to now trigger, then that completion is lost and a CQE is never posted.
Additionally, ensure that if an update does cause an existing POLLADD to complete, that the completion value isn't always overwritten with -ECANCELED. For that case, whatever iopoll_add() set the value to should just be retained.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71149.json" }- References
-
- https://git.kernel.org/stable/c/0126560370ed5217958b85657b590ad25e8b9c00
- https://git.kernel.org/stable/c/13a8f7b88c2d40c6b33f6216190478dda95d385f
- https://git.kernel.org/stable/c/84230ad2d2afbf0c44c32967e525c0ad92e26b4e
- https://git.kernel.org/stable/c/8b777ab48441b153502772ecfc78c107d4353f29
- https://git.kernel.org/stable/c/c1669c03bfbc2a9b5ebff4428eecebe734c646fe
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71149.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-71149
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced97b388d70b53fd7d286ac1b81e5a88bd6af98209Fixed8b777ab48441b153502772ecfc78c107d4353f29Fixed0126560370ed5217958b85657b590ad25e8b9c00Fixedc1669c03bfbc2a9b5ebff4428eecebe734c646feFixed13a8f7b88c2d40c6b33f6216190478dda95d385fFixed84230ad2d2afbf0c44c32967e525c0ad92e26b4e