CVE-2022-3176: Use-after-free in io_uring in Linux Kernel

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-16 · updated 2026-06-17
Weakness: CWE-416

Description

There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

Affected products

Debian Linux: 10.0, 11.0
Linux kernel: from 5.1 before 5.4.212; from 5.5 before 5.10.141; from 5.11 before 5.15.65; from 5.16 before 5.17 — fixed in 5.10.141, 5.15.65, 5.17, 5.4.212

How to fix

Upgrade to a fixed version: Linux kernel 5.10.141, 5.15.65, 5.17, 5.4.212. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3176 or the next vulnerability affects your stack