CVE-2021-47124

What it actually does

Use-after-free in Linux kernel io_uring due to incorrect reference counting on linked timeout requests: io_link_timeout_fn decrements the refcount once while a concurrent io_req_complete path also decrements it, allowing a freed request object to be accessed.

Why it matters to the business

Linux systems performing high-performance asynchronous I/O may experience kernel crashes, memory corruption, or potential privilege escalation; the affected AlmaLinux 8 gcc-toolset-9 packages must be updated to avoid operational disruption in servers and containers relying on io_uring.

How an attack unfolds

An attacker submits multiple io_uring SQEs that create linked timeout requests, then races the master request completion against the timeout callback to trigger the double decrement and subsequent use of the freed request structure.

How to fix it

Upgrade all listed AlmaLinux 8 gcc-toolset-9 packages to version 9.2.1-2.3.el8 or later; rebuild and redeploy any kernels or user-space components compiled with the vulnerable toolset.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases; inspect kernel dmesg for absence of refcount_warn_saturate warnings originating from io_uring paths after upgrade.

Typical attack path

1. Issue io_uring_enter with SQEs containing linked timeouts
2. Trigger concurrent completion of the master request via another thread or signal
3. Cause refcount underflow in io_put_req / io_queue_linked_timeout
4. Access the freed request object to achieve memory corruption or denial of service

How to detect it

Search kernel logs (dmesg, journalctl) for refcount_warn_saturate call traces mentioning io_put_req, io_queue_linked_timeout, or __io_queue_sqe; correlate with processes using io_uring syscalls.

• refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28
• io_put_req fs/io_uring.c:2140
• io_queue_linked_timeout fs/io_uring.c:6300
• __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354

What your security team should do

• Apply the gcc-toolset-9 package updates across all AlmaLinux 8 systems within the next maintenance window
• Disable io_uring via sysctl where the workload permits until patches are deployed
• Add kernel log monitoring for refcount warnings tied to fs/io_uring.c
• Review and restrict CAP_SYS_ADMIN or unprivileged io_uring usage via seccomp or landlock