CVE-2022-50234

io_uring/af_unix: defer registered files gc to io_uring release

State
Published
Severity
7.8 High
Published
Sep 15, 2025
Updated
Aug 5, 2026
Reserved
Jun 18, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/af_unix: defer registered files gc to io_uring release

Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to consider io_uring registered files for cycle detection but not actually putting them down. Because io_uring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free().

[axboe: add kerneldoc comment to skb, fold in skb leak fix]

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6b06314c47e141031be043539900d80d2c7ba10f to before 04df9719df1865f6770af9bc7880874af0e594b2Affected
  • 6b06314c47e141031be043539900d80d2c7ba10f to before c378c479c5175833bb22ff71974cda47d7b05401Affected
  • 6b06314c47e141031be043539900d80d2c7ba10f to before 813d8fe5d30388f73a21d3a2bf46b0a1fd72498cAffected
  • 6b06314c47e141031be043539900d80d2c7ba10f to before b4293c01ee0d0ecdd3cb5801e13f62271144667aAffected
  • 6b06314c47e141031be043539900d80d2c7ba10f to before 75e94c7e8859e58aadc15a98cc9704edff47d4f2Affected
  • 6b06314c47e141031be043539900d80d2c7ba10f to before 0091bfc81741b8d3aeb3b7ab8636f911b2de6e80Affected
LinuxLinux
  • 5.1Affected
  • before 5.1Not affected
  • 5.4.220 through 5.4.*Not affected
  • 5.10.150 through 5.10.*Not affected
  • 5.15.75 through 5.15.*Not affected
  • 5.19.17 through 5.19.*Not affected
  • 6.0.3 through 6.0.*Not affected
  • 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.