CVE-2023-52926

io_uring/rw: split io_read() into a helper

State: Published
Severity: 7.8 High
Published: Feb 24, 2025
Updated: Aug 5, 2026
Reserved: Aug 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

IORING_OP_READ did not correctly consume the provided buffer list when read i/o returned < 0 (except for -EAGAIN and -EIOCBQUEUED return). This can lead to a potential use-after-free when the completion via io_rw_done runs at separate context.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 72060434a14caea20925e492310d6e680e3f9007Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 6c27fc6a783c8a77c756dd5461b15e465020d075Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before a08d195b586a217d76b42062f88f375a3eedda4dAffected
LinuxLinux	5.1Affected before 5.1Not affected 6.1.122 through 6.1.Not affected 6.6.68 through 6.6.Not affected 6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.