Executive brief
A vulnerability in the Linux kernel's io_uring subsystem could allow a local user to view small amounts of sensitive information from the computer's memory. This occurs because the system fails to clear internal data buffers before sending them back to a user's application. While not allowing full control of the system, it could potentially leak data from other processes or previous operations.
Technical details
An information leak exists in the Linux kernel's io_uring implementation of IORING_OP_WAITID. The vulnerability is caused by the failure to initialize the 'info' field in 'struct io_waitid' during the request preparation phase (io_waitid_prep). If a wait operation completes without reporting a child event, the kernel may return to userspace without writing to the 'wo_info' structure, causing 'io_waitid_finish' to copy uninitialized, stale bytes from the reused 'io_kiocb' command storage to userspace. This allows a local attacker to read fragments of kernel memory. The issue has been resolved by adding a memset to zero-initialize the result storage during preparation.
Affected products
- Linux Linux Kernel 6.7+
Timeline
- 2026-05-16: patched: Initial patch submitted by Heechan Kang
- 2026-06-09: disclosed: CVE published