CVE-2025-40364 — Missing Release of Memory after Effective Lifetime in Linux
Severity
7.8HIGHNVD
EPSS
0.1%
top 77.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 18
Latest updateSep 3
Description
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix io_req_prep_async with provided buffers
io_req_prep_async() can import provided buffers, commit the ring state
by giving up on that before, it'll be reimported later if needed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages5 packages
▶CVEListV5linux/linuxc7fb19428d67dd0a2a78a4f237af01d39c78dc5a — 233b210a678bddf8b49b02a070074a52b87e6d43+7
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-24g7-95rm-cqcc: In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix io_req_prep_async with provided buffers
io_req_prep_async() can im↗2025-04-18
OSV▶
CVE-2025-40364: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can impo↗2025-04-18