Review reviewHigh

CVE-2025-38106

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x670 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? getrusage+0x1109/0x1a60 kasan_report...

CVSS: 7.8
EPSS: 0.16%
CISA KEV: Not listed
Published: 2025.07.03

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.16%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 3fcb9d17206e31630f802a3ab52081d1342b8ed9 < af8c13f9ee040b9a287ba246cf0055f7c77b7cc8, >= 3fcb9d17206e31630f802a3ab52081d1342b8ed9 < d0932758a0a77b38ba1b39564f3b7aba12407061, >= 3fcb9d17206e31630f802a3ab52081d1342b8ed9 < ac0b8b327a5677dc6fecdf353d808161525b1ff0, >= 6.9, >= 6.9 < 6.12.34, >= 6.13 < 6.15.3, 6.16
Fixed versions: 6.12.34, 6.15.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416