CVE-2025-68317
Description
A flaw was found in the Linux kernel. A local attacker could exploit an improper handling of chained notification contexts within the io_uring/zctx component. This could lead to a denial of service (DoS) on the system.
Statement
A low impact denial-of-service flaw was found in the Linux kernel's io_uring zero-copy send notification handling (io_uring/notif.c). The send zero-copy code links ubuf_info notification structures only for requests originating from the same zero-copy context, but that assumption was not validated when chained notifications completed. A local attacker able to submit io_uring requests could exploit this improper handling of chained notification contexts to cause a denial of service. This flaw affects the kernels shipped in Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10 (kernel); Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1.1 are not affected because the vulnerable code is not present in those kernels. Because this flaw is rated Low severity, the fix for the affected Red Hat Enterprise Linux 9 and 10 streams is deferred to a future scheduled kernel update; the residual risk is a local user causing a denial of service, and only on systems where io_uring has been explicitly enabled by an administrator, since in the default Red Hat Enterprise Linux kernel io_uring is disabled and cannot be used unless enabled through the kernel.io_uring_disabled sysctl parameter. Red Hat assesses the severity of this flaw as Low (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record severity of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the available technical evidence supports an availability-only impact, with no demonstrated confidentiality or integrity impact.
Mitigation
This flaw can only be triggered through the io_uring interface, which is disabled by default in Red Hat Enterprise Linux 9 and 10 (kernel.io_uring_disabled=2); no action is needed on systems where io_uring has not been explicitly enabled. On systems where an administrator has enabled io_uring, exploitation can be prevented by disabling it again: set the kernel.io_uring_disabled sysctl to 2, for example by running `sysctl -w kernel.io_uring_disabled=2`, and make the setting persistent via /etc/sysctl.conf or a file under /etc/sysctl.d/. With this setting, io_uring_setup() fails with -EPERM for all processes; note that applications relying on io_uring are affected, and io_uring instances that already exist at the time of the change can still be used.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
