CVE-2022-29582: Debian Linux

High severity, CVSS 7.0. EPSS: 0.8% chance of exploitation in the next 30 days.

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: before 5.10.111 (fixed in 5.10.111); from 5.11, before 5.15.34 (fixed in 5.15.34); from 5.16, before 5.16.20 (fixed in 5.16.20); from 5.17, before 5.17.3 (fixed in 5.17.3)

Published 2022-04-22. Last modified 2026-08-13.