Skip to content
OpenAdvisories
Unscored CVE-2021-20226 EUVD-2021-7666GHSA-vwgf-gfhw-h447

A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servi…

Published Feb 23, 2021 · Updated Aug 3, 2024 · Assigned by redhat

Description

A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

Affected products

VendorProductAffectedFixed
— kernel kernel 5.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.10.4-1 —
Debian 13 linux 5.10.4-1 —
Debian 12 linux 5.10.4-1 —
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-hwe-5.8 5.8.0-34.37~20.04.2 —
Ubuntu 20.04 LTS linux-riscv +2 No fix yet —
Ubuntu 18.04 LTS linux-gcp +12 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —

References