Riskcovery

CVE-2021-47123

io_uring: fix ltout double free on completion race

State
Published
Severity
7.8 High
Published
Mar 15, 2024
Updated
Aug 5, 2026
Reserved
Mar 4, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix ltout double free on completion race

Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 90cd7e424969d29aff653333b4dcb4e2e199d791 to before 1f64f5e903b9d1d157875721e02adadc9d6f0a5dAffected
  • 90cd7e424969d29aff653333b4dcb4e2e199d791 to before 447c19f3b5074409c794b350b10306e1da1ef4baAffected
LinuxLinux
  • 5.11Affected
  • before 5.11Not affected
  • 5.12.10 through 5.12.*Not affected
  • 5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.