title: Use-after-free in io_uring ad work_flags in Linux Kernel
description: io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859
problem types: CWE-416 Use After Free
affected:
{
vendor: Linux Kernel
product: Linux Kernel
versions:
version: unspecified, lessThan: df3f3bb5059d20ef094d6b2f0256c4bf4127a859, status: affected, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
]