CVE-2025-23154

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: fix io_req_post_cqe abuse by send bundle

[ 114.987980][ T5313] WARNING: CPU: 6 PID: 5313 at io_uring/io_uring.c:872 io_req_post_cqe+0x12e/0x4f0

[ 114.991597][ T5313] RIP: 0010:io_req_post_cqe+0x12e/0x4f0

[ 115.001880][ T5313] Call Trace:

[ 115.002222][ T5313] <TASK>

[ 115.007813][ T5313] io_send+0x4fe/0x10f0

[ 115.009317][ T5313] io_issue_sqe+0x1a6/0x1740

[ 115.012094][ T5313] io_wq_submit_work+0x38b/0xed0

[ 115.013223][ T5313] io_worker_handle_work+0x62a/0x1600

[ 115.013876][ T5313] io_wq_worker+0x34f/0xdf0

As the comment states, io_req_post_cqe() should only be used by

multishot requests, i.e. REQ_F_APOLL_MULTISHOT, which bundled sends are

not. Add a flag signifying whether a request wants to post multiple

CQEs. Eventually REQ_F_APOLL_MULTISHOT should imply the new flag, but

that's left out for simplicity.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References