Executive brief
A vulnerability in the Linux kernel's high-performance I/O interface, io_uring, could allow local attackers to cause data corruption or potentially gain unauthorized access to information. The issue occurs when the system handles network data using shared memory buffers, failing to properly release them during certain retry operations. This could lead to multiple network connections accidentally using the same memory space, resulting in unpredictable application behavior or security breaches.
Technical details
A vulnerability exists in the Linux kernel io_uring/net subsystem where ring-provided buffers are improperly pinned across multiple execution contexts during partial retries. When MSG_WAITALL is set or streaming sockets process insufficient data, the kernel may fail to recycle or commit the buffer, leading to two primary risks: use-after-free scenarios if the buffer ring is unregistered before a retry, and memory aliasing if multiple sockets consume the same buffer group. This can result in an out-of-bounds write (CWE-787) or data corruption. The issue is resolved by ensuring partial retries commit provided buffers rather than pinning them. Patches are available for multiple stable kernel branches including 6.6.y, 6.12.y, 6.15.y, and 6.16.y.
Affected products
- Linux Linux Kernel 6.4 to 6.6.102, 6.7 to 6.12.43, 6.13 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-12: other: Fix authored by Jens Axboe
- 2025-08-20: patched: Fix committed to stable branches
- 2025-09-04: disclosed: CVE published
References
- https://git.kernel.org/stable/c/21a4ddb0f5e933f372808c10b9ac704505751bb1
- https://git.kernel.org/stable/c/2eb7937b5fc7fcd90eab7bebb0181214b61b9283
- https://git.kernel.org/stable/c/3b53dc1c641f2884d4750fc25aaf6c36b90db606
- https://git.kernel.org/stable/c/41b70df5b38bc80967d2e0ed55cc3c3896bba781
- https://git.kernel.org/stable/c/fe9da1812f8697a38f7e30991d568ec199e16059