Executive brief
A vulnerability in the Linux kernel's io_uring subsystem could allow a local user to cause system instability or data corruption. io_uring is a high-performance interface used by applications to perform fast input/output operations. An attacker could exploit this flaw to potentially gain unauthorized access to data or crash the system, impacting overall operational reliability.
Technical details
An integer overflow vulnerability exists in the io_uring subsystem of the Linux kernel, specifically within the io_estimate_bvec_size() function in io_uring/rsrc.c. The flaw occurs when calculating the number of segments for registered buffers; the calculated value can exceed the capacity of an integer, leading to truncation. This truncation results in memory corruption when the truncated value is used for subsequent memory operations. A local attacker with standard user privileges can trigger this overflow by providing specially crafted vectored registered buffers. The issue has been resolved by adding overflow checks that return -EOVERFLOW if the segment count exceeds INT_MAX. Fixes are available in stable kernel updates (e.g., commits 146eb58 and 826ce37).
Affected products
- Linux Linux Kernel 6.15 to 6.17.8
Timeline
- 2025-12-08: disclosed
- 2025-11-07: patched: Initial fix commit authored