CVE-2025-68317

A flaw was found in the Linux kernel. A local attacker could exploit an improper handling of chained notification contexts within the io_uring/zctx component. This could lead to a denial of service (DoS) on the system.

A low impact denial-of-service flaw was found in the Linux kernel's io_uring zero-copy send notification handling (io_uring/notif.c). The send zero-copy code links ubuf_info notification structures only for requests originating from the same zero-copy context, but that assumption was not validated when chained notifications completed. A local attacker able to submit io_uring requests could exploit this improper handling of chained notification contexts to cause a denial of service. This flaw affects the kernels shipped in Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10 (kernel); Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1.1 are not affected because the vulnerable code is not present in those kernels. Because this flaw is rated Low severity, the fix for the affected Red Hat Enterprise Linux 9 and 10 streams is deferred to a future scheduled kernel update; the residual risk is a local user causing a denial of service, and only on systems where io_uring has been explicitly enabled by an administrator, since in the default Red Hat Enterprise Linux kernel io_uring is disabled and cannot be used unless enabled through the kernel.io_uring_disabled sysctl parameter. Red Hat assesses the severity of this flaw as Low (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record severity of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the available technical evidence supports an availability-only impact, with no demonstrated confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can only be triggered through the io_uring interface, which is disabled by default in Red Hat Enterprise Linux 9 and 10 (kernel.io_uring_disabled=2); no action is needed on systems where io_uring has not been explicitly enabled. On systems where an administrator has enabled io_uring, exploitation can be prevented by disabling it again: set the kernel.io_uring_disabled sysctl to 2, for example by running sysctl -w kernel.io_uring_disabled=2, and make the setting persistent via /etc/sysctl.conf or a file under /etc/sysctl.d/. With this setting, io_uring_setup() fails with -EPERM for all processes; note that applications relying on io_uring are affected, and io_uring instances that already exist at the time of the change can still be used.