Executive brief
A vulnerability was identified in the Linux kernel's high-performance I/O framework (io_uring) specifically affecting network command handling. A programming error in how the system manages network data buffers could lead to system instability or unauthorized access to sensitive information. This issue primarily impacts systems utilizing advanced networking features within the Linux environment.
Technical details
A vulnerability exists in the io_uring/cmd_net.c component of the Linux kernel due to transposed arguments in the skb_queue_splice() function within io_uring_cmd_timestamp(). When a timestamp retrieval operation needs to be retried, the kernel attempts to splice a local list of socket buffers (SKBs) back into the socket queue; however, the incorrect argument order causes the splice to occur in the wrong direction into an on-stack list. This logic error can result in memory corruption or local privilege escalation. The issue was introduced in the 'tx timestamping' command support and has been patched in stable kernel releases.
Affected products
- Linux Linux Kernel 6.17 to 6.17.9
Timeline
- 2025-11-20: patched: Initial fix committed by Jens Axboe
- 2025-12-16: disclosed: CVE-2025-68234 published