CVSS 7.8 · High EPSS 0,15%
Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut CNA.
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken. Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.15.82 hingga sebelum 5.16 |
| linux | linux kernel | Versi 6.0.11 hingga sebelum 6.1 |
| linux | linux kernel | Versi 6.1.1 hingga sebelum 6.1.175 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.140 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.86 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.18.27 |
| linux | linux kernel | Versi 6.19 hingga sebelum 7.0.4 |
| linux | linux kernel | Versi 6.1 |
| linux | linux kernel | Versi 6.1 rc7 |
| linux | linux kernel | Versi 6.1 rc8 |