CVE-2025-21630

What it actually does

Uninitialized msg_inq field in kernel message structure can be read during io_uring recv operations when the first submission fails and the network stack does not populate the value, resulting in use of uninitialized kernel memory.

Why it matters to the business

Systems running affected Linux kernels may experience kernel warnings or unpredictable behavior in high-performance networking workloads using io_uring, potentially impacting stability of services on Debian 13 deployments until upgraded.

How an attack unfolds

An attacker triggers io_uring recv submissions in a sequence that causes the first operation to fail without the network stack honoring msg_get_inq, allowing the uninitialized msg_inq value to be consumed in subsequent receive buffer selection logic.

How to fix it

Upgrade the linux package on Debian 13 to version 6.12.9-1 or later; rebuild and reboot systems after package installation to activate the fix that initializes msg_inq to zero at allocation time.

How to confirm the fix worked

Confirm the running kernel version reports 6.12.9-1 or newer via uname -r; recompile with KMSAN enabled and retest io_uring recv paths to verify the uninit-value warning is no longer reported.

Typical attack path

1. Identify a target process using io_uring for network receives
2. Submit crafted recv requests via io_uring_enter to hit the uninitialized path
3. Force failure conditions on the initial recv so networking stack does not set msg_inq
4. Observe or trigger use of the uninitialized value in io_recv_buf_select

How to detect it

Review kernel logs for KMSAN uninit-value reports referencing io_recv_buf_select or io_uring/net.c; monitor for unexpected task_work or io_uring_enter activity in processes handling network I/O.

What your security team should do

• Prioritize patching all Debian 13 systems to linux 6.12.9-1 within maintenance windows
• Audit workloads for heavy io_uring network usage and schedule earlier updates for those hosts
• Enable kernel memory sanitizers in test environments to catch similar issues before production deployment