Executive brief
A vulnerability in the Linux kernel's high-performance I/O framework (io_uring) could allow a system to receive more data than requested during network operations. This flaw affects the zero-copy receive (zcrx) feature, which is used to speed up data processing by reducing memory copying. An exploit could lead to memory corruption or system instability, potentially impacting the availability and security of servers using these advanced networking features.
Technical details
The vulnerability exists in the io_uring/zcrx.c component of the Linux kernel. The function io_zcrx_recv_skb() incorrectly adjusts the desc->count variable for all received buffers, including those in fragment lists, before making recursive calls to process those same fragment lists. This logic error results in double accounting of the received data, leading to an integer underflow of the count descriptor. An attacker could potentially leverage this to cause the kernel to receive more data than allocated, resulting in memory corruption or a denial-of-service condition. The issue was introduced in the zero-copy receive read limit implementation and has been patched in stable kernel releases.
Affected products
- Linux Linux Kernel 6.15 to 6.17.3
Timeline
- 2025-10-08: patched: Initial fix committed to Linux kernel source
- 2025-10-28: disclosed: CVE-2025-40046 published