CVE-2024-41001

io_uring/sqpoll: work around a potential audit memory leak

MEDIUM
5.5
CVSS Score
Published: July 12, 2024 at 12:37 PM UTC
Updated: June 17, 2026 at 07:47 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 (size 128): comm "iou-sqp-455", pid 457, jiffies 4294894164 hex dump (first 32 bytes): 02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2e481b1a): [<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 [<000000009c30bb45>] kmalloc_trace+0x228/0x358 [<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 [<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 [<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 [<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 [<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 [<00000000d999b491>] ret_from_fork+0x10/0x20 which can can happen if: 1) The command type does something on the prep side that triggers an audit call. 2) The thread hasn't done any operations before this that triggered an audit call inside ->issue(), where we have audit_uring_entry() and audit_uring_exit(). Work around this by issuing a blanket NOP operation before the SQPOLL does anything.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 6.1.965.1 ≤ v < 6.1.965.1 ≤ v < 6.105.1 ≤ v < 6.6.365.1 ≤ v < 6.9.76.2 ≤ v < 6.6.366.7 ≤ v < 6.9.72b188cc1bb857a9d4701ae59aa7768b5124e262e5.1
Vendor states this is fixed in 55c22375cbaa24f77dd13f9ae0642915444a1227 (fixed)
Vendor states this is fixed in 9e810bd995823786ea30543e480e8a573e5e5667 (fixed)
Vendor states this is fixed in a40e90d9304629002fb17200f7779823a81191d3 (fixed)
Vendor states this is fixed in c4ce0ab27646f4206a9eb502d6fe45cb080e1cae (fixed)
Vendor states this is fixed in 5.1 (unaffected)
Vendor states this is fixed in 6.1.96 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.36 (unaffected)
Vendor states this is fixed in 6.9.7 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card