{"id":"CVE-2025-21836","revision":"e00f9d1481fe46eba70a4d111fb7c44d","records":[{"revision":"e00f9d1481fe46eba70a4d111fb7c44d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21836","aliases":[],"title":"io_uring/kbuf: reallocate buf lists on upgrade","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: reallocate buf lists on upgrade\n\nIORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it\nwas created for legacy selected buffer and has been emptied. It violates\nthe requirement that most of the field should stay stable after publish.\nAlways reallocate it instead.","state":0,"publishedAt":"2025-03-07T09:09:56.127+00:00","modifiedAt":"2026-10-15T21:51:53.98+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"io_uring/kbuf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2fcabce2d7d34f69a888146dab15b36a917f09d4\",\n                            \"lessThan\": \"146a185f6c05ee263db715f860620606303c4633\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fcabce2d7d34f69a888146dab15b36a917f09d4\",\n                            \"lessThan\": \"7d0dc28dae836caf7645fef62a10befc624dd17b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fcabce2d7d34f69a888146dab15b36a917f09d4\",\n                            \"lessThan\": \"2a5febbef40ce968e295a7aeaa5d5cbd9e3e5ad4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2fcabce2d7d34f69a888146dab15b36a917f09d4\",\n                            \"lessThan\": \"8802766324e1f5d414a81ac43365c20142e85603\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"io_uring/kbuf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.79\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.16\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.4\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/146a185f6c05ee263db715f860620606303c4633","https://git.kernel.org/stable/c/7d0dc28dae836caf7645fef62a10befc624dd17b","https://git.kernel.org/stable/c/2a5febbef40ce968e295a7aeaa5d5cbd9e3e5ad4","https://git.kernel.org/stable/c/8802766324e1f5d414a81ac43365c20142e85603","https://u1f383.github.io/slides/talks/2025_Hexacon-Deja_Vu_in_Linux_io_uring_Breaking_Memory_Sharing_Again_After_Generations_of_Fixes.pdf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21836","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21836","identifiers":["CVE-2025-21836"]},"retained":false,"historicalAffected":[]}],"coverage":[]}