CVE-2025-21836

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached only through the io_uring_setup/io_uring_register syscalls; there is no network or adjacent path, so exploitation requires local access to issue syscalls.

AC:LAttack complexity, low

The attacker performs every step themselves (create a legacy buffer group, empty it, upgrade the same bgid via PBUF_RING, then mmap), controlling both sides of any race; the trigger is fully deterministic and reliable.

PR:LPrivileges required, low

io_uring is available to unprivileged users by default (kernel.io_uring_disabled=0) and provided-buffer registration needs no capability, so only a basic local user account is required.

UI:NUser interaction, none

The entire sequence is driven by the attacking process; no action by any other user or victim is needed.

S:UScope, unchanged

The corruption is confined to the kernel's own security authority (standard local privilege escalation) and does not cross a VM, IOMMU, or sandbox boundary.

C:HConfidentiality impact, high

The type confusion / use-after-free of the io_buffer_list and the retained user mapping to freed kernel pages give the attacker read access to reallocated kernel memory, enabling arbitrary kernel information disclosure.

I:HIntegrity impact, high

The same UAF and shared-page primitive give write access to freed/reallocated kernel memory, exploitable for arbitrary kernel write and privilege escalation as demonstrated for this io_uring buffer-ring bug class.

A:HAvailability impact, high

At minimum the type confusion and use-after-free corrupt kernel structures, causing an oops/panic and denial of service.