CVE-2023-0240: Use after free in io_uring in the Linux Kernel

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-30 · updated 2026-06-17
Weakness: CWE-416

Description

There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

Affected products

Linux kernel: before 5.10 — fixed in 5.10

How to fix

Upgrade to a fixed version: Linux kernel 5.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-0240 or the next vulnerability affects your stack