CVE-2025-21655: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21655 Overview

CVE-2025-21655 is a Use After Free vulnerability in the Linux kernel's io_uring subsystem, specifically within the eventfd signaling mechanism. The vulnerability occurs in the io_eventfd_do_signal() function, which is invoked from an RCU (Read-Copy-Update) callback. When dropping the reference to the io_ev_fd structure, the code incorrectly calls io_eventfd_free() directly if the refcount drops to zero, rather than properly deferring the free operation through another RCU grace period. This improper memory management can lead to a denial of service condition through memory corruption.

Critical Impact

Local attackers with low privileges can exploit this Use After Free condition in the io_uring eventfd subsystem to cause system instability or denial of service through improper RCU callback handling.

Affected Products

• Linux Kernel versions prior to patched releases
• Linux Kernel 6.13-rc1 through 6.13-rc6
• Various Linux distributions using affected kernel versions

Discovery Timeline

• 2025-01-20 - CVE CVE-2025-21655 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21655

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free) and resides in the Linux kernel's io_uring subsystem, which is a high-performance asynchronous I/O interface. The flaw manifests in the eventfd signaling pathway where RCU (Read-Copy-Update) synchronization is not properly implemented during object deallocation.

The io_uring subsystem uses eventfd for notification purposes, allowing userspace applications to receive completion events. When io_eventfd_do_signal() is invoked from an RCU callback and determines that the reference count for io_ev_fd has dropped to zero, it directly calls the free function instead of deferring the deallocation. This creates a race condition window where other RCU readers may still be accessing the io_ev_fd structure, leading to use-after-free scenarios.

The vulnerability requires local access and high attack complexity to exploit, as it depends on precise timing of concurrent operations within the kernel's RCU subsystem. Successful exploitation can result in denial of service through kernel memory corruption or system instability.

Root Cause

The root cause is improper memory lifecycle management within the io_uring eventfd subsystem. When the io_eventfd_do_signal() function is called from an RCU callback context, it performs an open-coded decrement-and-test operation followed by a direct call to io_eventfd_free(). This violates RCU semantics because the freeing should be deferred through another RCU grace period to ensure all concurrent readers have completed their access.

The fix involves replacing the direct free call with io_eventfd_put(), which properly defers the memory deallocation through the RCU mechanism, ensuring that any ongoing readers complete their operations before the memory is reclaimed.

Attack Vector

The attack vector is local, requiring an attacker to have access to the target system with low privileges. The attacker would need to interact with the io_uring subsystem and trigger specific timing conditions where:

1. An io_uring instance with eventfd notification is set up
2. The eventfd signaling path is triggered during RCU callback execution
3. The reference count drops to zero while other RCU readers may still be accessing the structure

Due to the high attack complexity and the need for precise timing, practical exploitation is challenging but not impossible in systems under heavy io_uring workloads.

Detection Methods for CVE-2025-21655

Indicators of Compromise

• Kernel oops or panic messages referencing io_eventfd_do_signal or io_eventfd_free functions
• Unexpected system crashes or instability on systems using io_uring extensively
• KASAN (Kernel Address Sanitizer) reports indicating use-after-free in io_uring eventfd code paths
• Anomalous kernel memory allocation patterns in io_uring subsystem

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in development and testing environments to detect use-after-free conditions
• Monitor kernel logs for oops messages related to io_uring or eventfd subsystems
• Implement kernel function tracing on io_eventfd_do_signal and io_eventfd_put to identify anomalous execution patterns
• Deploy SentinelOne Singularity Platform for real-time kernel-level threat detection and behavioral analysis

Monitoring Recommendations

• Configure kernel crash dump collection to capture diagnostic information if exploitation occurs
• Enable audit logging for io_uring system calls to track potentially malicious usage patterns
• Monitor system stability metrics for unexplained crashes or performance degradation
• Review Project Zero Issue 388499293 for additional technical context

How to Mitigate CVE-2025-21655

Immediate Actions Required

• Update to a patched Linux kernel version as soon as available for your distribution
• Review Debian LTS Security Announcement for distribution-specific guidance
• Consider disabling io_uring functionality temporarily if not required by critical applications
• Apply vendor-provided kernel patches from the official kernel.org commits

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix involves using io_eventfd_put() instead of directly calling io_eventfd_free(), which ensures proper RCU grace period deferral before memory is reclaimed.

Official patches are available at:

• Kernel Commit 6b63308c28987c6010b1180c72a6db4df6c68033
• Kernel Commit 8efff2aa2d95dc437ab67c5b4a9f1d3f367baa10
• Kernel Commit a7085c3ae43b86d4b3d1b8275e6a67f14257e3b7
• Kernel Commit c9a40292a44e78f71258b8522655bffaf5753bdb

Workarounds

• Disable io_uring at boot time using kernel parameter io_uring_disabled=2 if the functionality is not required
• Restrict access to io_uring through seccomp filters or kernel configuration options
• Limit unprivileged access to io_uring by setting /proc/sys/kernel/io_uring_disabled to appropriate values
• Deploy security modules like SELinux or AppArmor to restrict io_uring system call access for non-essential processes

# Disable io_uring for unprivileged users
echo 2 > /proc/sys/kernel/io_uring_disabled

# Alternatively, add to kernel boot parameters
# io_uring_disabled=2