Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem, which manages high-performance input/output operations. A race condition exists when the system attempts to recycle memory buffers, potentially allowing a local attacker to cause a system crash or gain unauthorized access to data. This issue occurs when a buffer is reused after its underlying list has been modified or removed by another process.
Technical details
A race condition exists in io_uring/kbuf.c during the recycling of legacy buffers. There is a timing gap between when a buffer is acquired and when it is recycled; if the buffer list is empty, it can be 'upgraded' to a ring-provided type or removed while a request is in-flight in the io-wq (io_uring worker queue). The io_kbuf_recycle_legacy function failed to verify if the target buffer_list still existed or remained a legacy type before adding the buffer back to the list. This could lead to use-after-free or type confusion scenarios. The fix introduces checks to ensure the buffer list is still valid and not mapped (ring-based) before recycling.
Affected products
- Linux Linux kernel Fixed in 6.1, 6.6, 6.7, 6.8, and later versions
Timeline
- 2026-03-12: patched: Initial fix committed by Jens Axboe
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f
- https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83
- https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4
- https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c
- https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f
- https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa