Executive brief
A vulnerability exists in the Linux kernel's io_uring subsystem, which is used for high-performance input/output operations. The flaw involves how the system handles memory alignment for user-provided data buffers. If exploited, a local attacker could potentially cause a system crash or gain unauthorized access to sensitive information.
Technical details
The vulnerability exists in the io_uring/rsrc component of the Linux kernel. It stems from an incorrect assumption regarding the alignment of user-provided virtual addresses (vaddr) when calculating the offset of the first page into a folio after multi-hugepage buffer coalescing. The original code used a bitmask logic that did not account for unaligned user pointers. An attacker with local access could exploit this flaw to trigger memory safety issues. The fix replaces the flawed bitmask logic with a proper calculation using folio_page_idx and PAGE_MASK to correctly determine the offset. Patches have been released for various stable branches including 6.12.36 and 6.15.5.
Affected products
- Linux Linux Kernel 6.12 to 6.12.36, 6.15 to 6.15.5
Timeline
- 2025-12-04: advisory: NVD publication date
- 2025-06-24: patched: Initial fix commit in kernel.org stable tree