Executive brief
A vulnerability was identified in the Linux kernel's high-performance I/O framework, io_uring. The issue involves how the system handles memory buffers during network data transfers, potentially leading to memory management errors because the system tracks the wrong internal object. If exploited, this could allow a local user to compromise the integrity or availability of the system, or potentially access sensitive data.
Technical details
A vulnerability exists in io_uring/net.c within the Linux kernel's implementation of vectored registered buffers for zero-copy (zctx) networking. The root cause is a lifetime management error where the `io_import_reg_vec` function incorrectly uses the primary request object (`req`) instead of the notification object (`sr->notif`) for buffer imports. Because these two objects can have different lifetimes, this mismatch can lead to use-after-free or other memory corruption scenarios when the request completes before the notification. The issue was introduced in the implementation of vectored registered buffers and is resolved by ensuring the vectored buffer import is correctly tied to the notification `io_kiocb`. Patches are available in stable kernel releases 6.17.11 and 6.18.
Affected products
- Linux Linux Kernel 6.15 to 6.17.10
Timeline
- 2025-11-24: patched: Initial fix commit by Jens Axboe
- 2025-12-16: disclosed: CVE published