CVE-2025-21633

What it actually does

Use-after-free read in thread_group_cputime due to sqd->task not being zeroed when SQPOLL tctx setup fails under allocation errors, allowing subsequent access to freed memory during io_uring fdinfo display.

Why it matters to the business

Kernel crashes, denial of service, or potential local privilege escalation on affected Linux systems, increasing operational risk and requiring urgent patching across server and desktop fleets.

How an attack unfolds

An attacker with local access triggers fault-injected allocation failures during SQPOLL task context setup in io_uring, leaving a dangling thread pointer; later access via getrusage or proc fdinfo reads the freed slab object, enabling memory corruption.

How to fix it

Upgrade the linux package on Debian 13 to version 6.12.10-1 or later; rebuild and reboot systems with the fixed kernel; apply vendor backports where available for other distributions.

How to confirm the fix worked

Verify running kernel version is at least 6.12.10-1 via uname or package manager; confirm absence of the described slab-use-after-free in syzkaller-style tests or kernel debug logs after io_uring SQPOLL operations.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Create an io_uring instance configured for SQPOLL
3. Force allocation failures during tctx setup via fault injection or similar
4. Trigger io_uring_show_fdinfo or related cputime paths to dereference the dangling pointer
5. Exploit resulting use-after-free for crash or escalation

How to detect it

Review kernel logs for KASAN slab-use-after-free reports referencing thread_group_cputime and io_uring_show_fdinfo; inspect audit or syslog entries around io_uring fdinfo access following SQPOLL creation attempts.

What your security team should do

• Prioritize kernel upgrades on all Debian 13 systems within the next maintenance window
• Restrict unprivileged io_uring usage via sysctl where feasible until patched
• Monitor for kernel oops or KASAN reports involving io_uring and cputime
• Test fixed kernels in staging environments before broad deployment