# CVE-2025-21630: linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/net: always initialize kmsg->msg.msg_in...

CVE-2025-21630 is fixed in linux on 1 platform by CVE-2025-21630 (version 6.12.9-1), released January 15, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-21630
- Priority: Routine
- CVSS: n/a
- EPSS: n/a
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 15, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  io_uring/net: always initialize kmsg->msg.msg_inq upfront  syzbot reports that ->msg_inq may get used uinitialized from the following path:  BUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline] BUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158  io_recv_buf_select io_uring/net.c:1094 [inline]  io_recv+0x930/0x1f90 io_uring/net.c:1158  io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740  io_queue_sqe io_uring/io_uring.c:1950 [inline]  io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374  io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057  tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121  tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139  task_work_run+0x268/0x310 kernel/task_work.c:239  io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343  io_cqring_wait io_uring/io_uring.c:2527 [inline]  __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline]  __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330  x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  and it is correct, as it's never initialized upfront. Hence the first submission can end up using it uninitialized, if the recv wasn't successful and the networking stack didn't honor ->msg_get_inq being set and filling in the output value of ->msg_inq as requested.  Set it to 0 upfront when it's allocated, just to silence this KMSAN warning. There's no side effect of using it uninitialized, it'll just potentially cause the next receive to use a recv value hint that's not accurate.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.9-1 | [CVE-2025-21630](https://patchblox.com/security/data/fix/linux/cve-2025-21630.md) | Jan 15, 2025 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.