A linux kernel security update has been released for Arch Linux.

ASA-202102-23: linux: arbitrary code execution

Arch Linux Security Advisory ASA-202102-23
=========================================
Severity: Medium
Date : 2021-02-12
CVE-ID : CVE-2021-3347
Package : linux
Type : arbitrary code execution
Remote : No
Link :   https://security.archlinux.org/AVG-1506

Summary
======
The package linux before version 5.10.12.arch1-1 is vulnerable to
arbitrary code execution.

Resolution
=========
Upgrade to 5.10.12.arch1-1.

# pacman -Syu "linux>=5.10.12.arch1-1"

The problem has been fixed upstream in version 5.10.12.arch1.

Workaround
=========
None.

Description
==========
An issue was discovered in the Linux kernel through 5.10.11. PI futexes
have a kernel stack use-after-free during fault handling, allowing
local users to execute code in the kernel, aka CID-34b1a1ce1458.

Impact
=====
An attacker can escalate privileges on the system by abusing io_uring
descriptor initialization.

References
=========
  https://www.openwall.com/lists/oss-security/2021/01/29/1
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?idbb3f7f1b03d5913b3f9d4236a488aa7774dfe9
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?idb79c55201f02ffd675e1231d731365e335c307
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id?cade200ab9a2a3be9e7f32a752c8d86b502ec7
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id!56ac1934166d6deb6cd0f6ffc4c1076ec63697
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?idlcc84f917d33312eb2846bd7b567639f585ad6d
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id?dac39d93987f7de1e20b3988c8685523247ae2
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id4b1a1ce1458f50ef27c54e28eb9b1947012907a
  https://security.archlinux.org/CVE-2021-3347