Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem, which is used for high-performance asynchronous input/output operations. An issue in how the system handles zero-copy network notifications could allow a local attacker to potentially cause a system crash or gain unauthorized access to data. This affects systems running specific versions of the Linux kernel, and updates have been released to address the flaw.
Technical details
A vulnerability in the Linux kernel's io_uring zero-copy (zctx) implementation arises from a failure to verify that chained notification contexts belong to the same io_ring_ctx. In the `io_notif_tw_complete` function in `io_uring/notif.c`, the kernel assumed that all linked `ubuf_info` requests originated from the same context. A local attacker could potentially exploit this mismatch to trigger a WARN_ON_ONCE or cause memory safety issues. The fix introduces a check to ensure the context of the notification matches the current ring context before proceeding with completion. Patches have been backported to various stable branches including 6.12.y and 6.17.y.
Affected products
- Linux Linux Kernel 6.10 to 6.12.58, 6.17.8
Timeline
- 2025-08-14: disclosed: Initial patch authored
- 2025-11-13: patched: Patch committed to stable trees
- 2025-12-16: advisory: CVE published