CVE-2025-21655

In the Linux kernel, the following vulnerability has been resolved:

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev_fd should be deferred another RCU grace period.

Just call io_eventfd_put() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.

This vulnerability is rated as Moderate severity for Red Hat because successful exploitation requires local unprivileged execution to win a timing race, restricting the attack surface to authenticated local processes. An attacker interacting with registered eventfd notifications in the io_uring subsystem can trigger premature memory deallocation, resulting in kernel memory corruption and a potential denial of service or privilege escalation. Earlier enterprise releases, including Red Hat Enterprise Linux 8 and 9, are unaffected because they lack the vulnerable deferred eventfd notification implementation.