HIGH
io_uring FixedBuffer OOB
CVE-2026-43006
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
02KernelScan AI Analysis
Risk summary
Local unprivileged users can trigger an out-of-bounds read in kernel memory by submitting zero-length fixed buffer operations via io_uring. This can lead to limited information disclosure of adjacent kernel slab memory (C:Low) and potential system crashes when the read hits unmapped guard pages (A:High).
Vulnerability analysis
The vulnerability occurs in io_import_fixed() when processing zero-length fixed buffer imports. The validate_fixed_range() function incorrectly allows buffer addresses at the exact end of registered regions when length is zero due to a strict greater-than comparison. This causes io_import_fixed() to compute an offset equal to imu->len, which makes the bvec skip logic advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. For large registered buffers, the bvec array may be vmalloc'd, causing the out-of-bounds read to hit a guard page and panic. The fix adds an early return when len is zero, preventing the bvec array walk entirely since zero-length imports have no data to transfer.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.22 | 040a1e7e0e2f |
| 6.19 | 6.19.12 | 40170fc1a79c |
| mainline | 7.0 | 111a12b422a8 |