Critical RCU Grace Period Deferral Vulnerability in Linux Kernel (CVE-2025-21655)
Summary
CVE-2025-21655: In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the ref... Affects linux versions < 6.1.128-1. Fixed in 6.1.128-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system calls. It is known for its robustness and versatility, powering everything from servers to embedded systems. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity and security. CVE-2025-21655 highlights a specific flaw in the io_uring subsystem, which facilitates asynchronous I/O operations, potentially leading to improper resource management.
Vulnerability Detail
The vulnerability arises from the improper handling of the io_eventfd_signal() function, which is invoked from an RCU (Read-Copy-Update) callback. When the reference count of the io_eventfd structure drops to zero, the function directly calls io_eventfd_free(), which is incorrect. This can lead to premature freeing of the io_eventfd structure, risking memory corruption and undefined behavior. The flaw underscores the importance of deferring the freeing of resources until after another RCU grace period, ensuring that all read-side critical sections have completed.
How To Fix
Minimum fixed version
6.1.128-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the io_uring subsystem until the kernel has been updated. This will mitigate the risk associated with the vulnerability until a permanent fix is applied.
Conclusion
CVE-2025-21655 represents a significant vulnerability within the Linux kernel's io_uring subsystem, emphasizing the need for timely updates and proper resource management. Users are encouraged to apply the necessary patches and utilize tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21655 is a vulnerability in the Linux kernel related to improper resource management in the io_uring subsystem, which could lead to memory corruption.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The vulnerability could lead to memory corruption, undefined behavior, and potential system crashes, compromising the stability and security of affected systems.
Yes, a patch has been released. Users are advised to update their Linux kernel to the latest version to mitigate the vulnerability.
If an immediate update is not possible, consider avoiding the use of the io_uring subsystem as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
