CVE-2023-52926

HIGH EPSS 12.7%
Published Feb 24, 20251y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Feb 24, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: IORING_OP_READ did not correctly consume the provided buffer list when read i/o returned < 0 (except for -EAGAIN and -EIOCBQUEUED return). This can lead to a potential use-after-free when the completion via io_rw_done runs at separate context.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
12.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 2

VendorProductVersionRange
linuxlinux_kernel*≥5.1  –  <6.1.122
linuxlinux_kernel*≥6.2  –  <6.6.68

References 4

  • git.kernel.org https://git.kernel.org/stable/c/6c27fc6a783c8a77c756dd5461b15e465020d075
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/72060434a14caea20925e492310d6e680e3f9007
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a08d195b586a217d76b42062f88f375a3eedda4d
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/6c27fc6a783c8a77c756dd5461b15e465020d075
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/72060434a14caea20925e492310d6e680e3f9007
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a08d195b586a217d76b42062f88f375a3eedda4d
    Patch