{"id":"CVE-2025-21630","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: always initialize kmsg-\u003emsg.msg_inq upfront\n\nsyzbot reports that -\u003emsg_inq may get used uinitialized from the\nfollowing path:\n\nBUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline]\nBUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_recv_buf_select io_uring/net.c:1094 [inline]\n io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740\n io_queue_sqe io_uring/io_uring.c:1950 [inline]\n io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374\n io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057\n tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121\n tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139\n task_work_run+0x268/0x310 kernel/task_work.c:239\n io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343\n io_cqring_wait io_uring/io_uring.c:2527 [inline]\n __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline]\n __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330\n __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330\n x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nand it is correct, as it's never initialized upfront. Hence the first\nsubmission can end up using it uninitialized, if the recv wasn't\nsuccessful and the networking stack didn't honor -\u003emsg_get_inq being set\nand filling in the output value of -\u003emsg_inq as requested.\n\nSet it to 0 upfront when it's allocated, just to silence this KMSAN\nwarning. There's no side effect of using it uninitialized, it'll just\npotentially cause the next receive to use a recv value hint that's not\naccurate.","modified":"2025-01-16T05:50:09.612645Z","published":"2025-01-15T13:15:15Z","withdrawn":"2025-01-17T12:47:10.753274Z","references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/127c280067167beb88461cd930f7c7a4bb3c7239"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21630"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.9-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.10-1","6.11.10-1~bpo12+1","6.11.2-1","6.11.4-1","6.11.5-1","6.11.5-1~bpo12+1","6.11.6-1","6.11.7-1","6.11.9-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.12.3-1","6.12.5-1","6.12.6-1","6.12.8-1","6.12~rc6-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21630.json"}}],"schema_version":"1.7.3"}