PT-2025-3309 · Linux · Linux Kernel

Published 2025-01-06 · Updated 2025-01-31 · CVE-2024-56762

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A use-after-free vulnerability has been identified in the Linux kernel's io uring/sqpoll component. This issue arises due to error handling races and can be triggered when io uring alloc task context() fails, allowing io sq thread() to run and complete before the rest of the error handling code. The vulnerability requires fault injection on the allocation side to be exploited in practice.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider restricting the use of the io uring/sqpoll component until a patch is available.

Related Identifiers

CVE-2024-56762

MGASA-2025-0030

MGASA-2025-0032

Affected Products

Linux Kernel

References · 24

• https://advisories.mageia.org/MGASA-2025-0030.html · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0030 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0032 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0032.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-56762 · Security Note
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.73 · Note
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.71 · Note
• https://bugs.mageia.org/show_bug.cgi?id=33961 · Note
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.68 · Note
• https://twitter.com/VulmonFeeds/status/1876352521800696281 · Twitter Post
• https://twitter.com/CVEnew/status/1876311001781739676 · Twitter Post
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.74 · Note
• https://git.kernel.org/stable/c/6237331361711810d8f2e3fbfe2f7a6f9548f5e0 · Note
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.67 · Note
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.66 · Note