CVE-2025-21655

What it actually does

Use-after-free in io_uring/eventfd path: io_eventfd_do_signal() invoked from RCU callback directly frees io_ev_fd via io_eventfd_free() on refcount drop instead of deferring via another RCU grace period.

Why it matters to the business

Kernel memory corruption on systems using io_uring with eventfd; may cause crashes, data corruption, or local privilege escalation, increasing operational risk and patching urgency for Linux deployments.

How an attack unfolds

Attacker triggers io_uring eventfd signaling from RCU context, races the reference drop to force direct free of io_ev_fd, then reuses the freed object in subsequent operations to corrupt kernel memory or escalate privileges.

How to fix it

Update Linux kernel to commit 6b63308c28987c6010b1180c72a6db4df6c68033 or later stable release containing the io_eventfd_put() fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; run io_uring eventfd test cases under RCU stress; verify no direct io_eventfd_free calls remain in io_eventfd_do_signal path via source inspection.

Typical attack path

1. Identify system with io_uring and eventfd usage enabled
2. Craft io_uring submission that triggers io_eventfd_signal from RCU callback
3. Race reference count drop to invoke direct io_eventfd_free
4. Reclaim freed io_ev_fd object for arbitrary kernel read/write
5. Escalate to root or trigger denial of service

How to detect it

Search kernel logs for RCU-related warnings or use-after-free oops mentioning io_ev_fd or io_eventfd; inspect auditd and syscall traces for unusual io_uring + eventfd combinations preceding crashes.

• io_ev_fd
• io_eventfd_free
• io_eventfd_put
• io_eventfd_do_signal
• io_uring eventfd signal RCU

What your security team should do

• Prioritize kernel upgrade on all production systems exposing io_uring
• Disable io_uring where not required via sysctl or seccomp
• Monitor for kernel oops or crashes involving eventfd and io_uring
• Apply updates before any public exploit maturation