CVE-2022-49791

io_uring: fix multishot accept request leaks

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix multishot accept request leaks Having REQ_F_POLLED set doesn't guarantee that the request is executed as a multishot from the polling path. Fortunately for us, if the code thinks it's multishot issue when it's not, it can only ask to skip completion so leaking the request. Use issue_flags to mark multipoll issues.

N/A

CVSS

Severity:

EPSS 0.03%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/0e4626de856ef8f25ecd9c716e76d4f95ce95639
https://git.kernel.org/stable/c/91482864768a874c4290ef93b84a78f4f1dac51b

Frequently Asked Questions

What is the severity of CVE-2022-49791?: CVE-2022-49791 has not yet been assigned a CVSS score.
How to fix CVE-2022-49791?: To fix CVE-2022-49791, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49791 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-49791 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49791?: CVE-2022-49791 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.