CVE-2025-40364

io_uring: fix io_req_prep_async with provided buffers

State: Published
Severity: 7.8 High
Published: Apr 18, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix io_req_prep_async with provided buffers

io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 233b210a678bddf8b49b02a070074a52b87e6d43Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a1b17713b32c75a90132ea2f92b1257f3bbc20f3Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before b86f1d51731e621e83305dc9564ae14c9ef752bfAffected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 35ae7910c349fb3c60439992e2e0e79061e95382Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before f0ef94553868d07c1b14d7743a7e2553e5a831a3Affected c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before d63b0e8a628e62ca85a0f7915230186bb92f8bb4Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.129 through 6.1.Not affected 6.6.78 through 6.6.Not affected 6.12.14 through 6.12.Not affected 6.13.3 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 233b210a678bddf8b49b02a070074a52b87e6d43Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a1b17713b32c75a90132ea2f92b1257f3bbc20f3Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before b86f1d51731e621e83305dc9564ae14c9ef752bfAffected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before 35ae7910c349fb3c60439992e2e0e79061e95382Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before f0ef94553868d07c1b14d7743a7e2553e5a831a3Affected
c7fb19428d67dd0a2a78a4f237af01d39c78dc5a to before d63b0e8a628e62ca85a0f7915230186bb92f8bb4Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.129 through 6.1.*Not affected
6.6.78 through 6.6.*Not affected
6.12.14 through 6.12.*Not affected
6.13.3 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.