Security readout for executives and security teams
Plain-English summary
A flaw in Linux io_uring can access a process structure after it has been freed, potentially corrupting kernel memory or crashing the system. Exploitation requires local, low-privileged access; it is not described as remotely reachable. Shared systems running untrusted workloads deserve faster attention than single-purpose, tightly controlled servers.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on multi-user or workload-hosting Linux systems. It does not warrant the same emergency response as an internet-exploitable flaw because local authenticated access is required and active exploitation is not documented. Expedite validated vendor updates during the next suitable maintenance window.
Technical view
A race in __io_uring_show_fdinfo() allows sq->thread to be released while fdinfo reads its task_struct. The existing ctx->uring_lock does not prevent that lifetime race. The published fix performs thread assignment and lookup under RCU and acquires a task_struct reference before use. KASAN confirmed a slab use-after-free during getrusage().
Likely exposure
Exposure is limited to Linux systems running an affected kernel with reachable io_uring functionality and local users or workloads. The bundle identifies affected entries including 6.9, 6.12.34, 6.15.3, and 6.16, but its version-range formatting is incomplete. Confirm exact exposure through distribution advisories and fix backport records.
Exploitation context
The CVSS 3.1 score is 7.8, reflecting local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of exploitation in the wild or a public weaponized exploit. The demonstrated result is a KASAN-detected kernel use-after-free.
Researcher notes
The failure involves task_struct lifetime management during io_uring fdinfo inspection. The source attributes the race to sq->thread exiting despite ctx->uring_lock. RCU lookup plus task reference acquisition addresses the lifetime gap. Exact vulnerable ranges, affected configurations, exploit reliability, and practical impact beyond the KASAN report are not fully established by the supplied bundle.
Mitigation direction
- Apply a distribution-supported kernel update containing the relevant stable fix.
- Reboot affected systems so the corrected kernel is actually running.
- Use vendor advisories to map backported fixes to distribution-specific package versions.
- Prioritize shared hosts and systems permitting untrusted local workloads.
Validation and detection
- Inventory running kernel versions across Linux systems.
- Check distribution changelogs for the referenced stable fix commits or an explicit CVE entry.
- After updating and rebooting, verify every system runs the intended corrected kernel.
- Review kernel diagnostics for matching io_uring, fdinfo, KASAN, or use-after-free events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38106 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/af8c13f9ee040b9a287ba246cf0055f7c77b7cc8CVE reference, Linux
- https://git.kernel.org/stable/c/d0932758a0a77b38ba1b39564f3b7aba12407061CVE reference, Linux
- https://git.kernel.org/stable/c/ac0b8b327a5677dc6fecdf353d808161525b1ff0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.