CVE-2025-38453

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU

syzbot reports that defer/local task_work adding via msg_ring can hit

a request that has been freed:

CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025

Call Trace:

<TASK>

dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:408 [inline]

print_report+0xd2/0x2b0 mm/kasan/report.c:521

kasan_report+0x118/0x150 mm/kasan/report.c:634

io_req_local_work_add io_uring/io_uring.c:1184 [inline]

__io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252

io_msg_remote_post io_uring/msg_ring.c:103 [inline]

io_msg_data_remote io_uring/msg_ring.c:133 [inline]

__io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151

io_msg_ring_data io_uring/msg_ring.c:173 [inline]

io_msg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References