CVE-2022-3176: Debian Linux

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Linux Linux Kernel: from 5.1, before 5.4.212 (fixed in 5.4.212); from 5.5, before 5.10.141 (fixed in 5.10.141); from 5.11, before 5.15.65 (fixed in 5.15.65); from 5.16, before 5.17 (fixed in 5.17)

Published 2022-09-16. Last modified 2026-06-17.