CVE-2025-21837: io_uring/uring_cmd: unconditionally copy SQEs at prep time
In the Linux kernel, the following vulnerability has been resolved:
iouring/uringcmd: unconditionally copy SQEs at prep time
This isn't generally necessary, but conditions have been observed where SQE data is accessed from the original SQE after prep has been done and outside of the initial issue. Opcode prep handlers must ensure that any SQE related data is stable beyond the prep phase, but uringcmd is a bit special in how it handles the SQE which makes it susceptible to reading stale data. If the application has reused the SQE before the original completes, then that can lead to data corruption.
Down the line we can relax this again once uringcmd has been sanitized a bit, and avoid unnecessarily copying the SQE.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21837?
CVE-2025-21837 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21837?
To fix CVE-2025-21837, update the Linux kernel to the latest version that contains the patch for this vulnerability.
What software is affected by CVE-2025-21837?
CVE-2025-21837 affects the Linux kernel, specifically impacting implementations that utilize io_uring functions.
What type of vulnerability is CVE-2025-21837?
CVE-2025-21837 is an input validation vulnerability related to io_uring command handling in the Linux kernel.
Can CVE-2025-21837 lead to exploitations in user applications?
Yes, CVE-2025-21837 can potentially be exploited by malicious applications to gain unauthorized access or control over system resources.