PT-2025-18408 · Linux+4 · Linux Kernel+4
Published
2025-03-27
·
Updated
2026-01-26
·
CVE-2025-23154
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability has been resolved in the Linux kernel related to the
io uring/net component, specifically regarding the abuse of io req post cqe by send bundles. The issue arises because io req post cqe should only be used by multishot requests, but bundled sends are not multishot requests. A flag has been added to signify whether a request wants to post multiple CQEs. The io req post cqe function is called from io send, which is part of the io uring subsystem.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse
Ubuntu