HIGH
io_uring SQE OOB
CVE-2026-43442
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI6.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, the boundary check for 128-byte SQE operations in io_init_req() validated the logical SQ head position rather than the physical SQE index. The existing check: !(ctx->cached_sq_head & (ctx->sq_entries - 1)) ensures the logical position isn't at the end of the ring, which is correct for NO_SQARRAY rings where physical == logical. However, when sq_array is present, an unprivileged user can remap any logical position to an arbitrary physical index via sq_array. Setting sq_array[N] = sq_entries - 1 places a 128-byte operation at the last physical SQE slot, causing the 128-byte memcpy in io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE array. Replace the cached_sq_head alignment check with a direct validation of the physical SQE index, which correctly handles both sq_array and NO_SQARRAY cases.
02KernelScan AI Analysis
Risk summary
Local unprivileged users with access to io_uring can trigger a 64-byte out-of-bounds read from kernel memory by remapping SQE indices in mixed-size rings. This results in information disclosure of adjacent kernel memory (C:Low) and can be steered to cause a kernel panic when the overread crosses a vmalloc guard page or unmapped boundary (A:High). There is no direct integrity impact because the bug is a read-only operation.
Vulnerability analysis
The vulnerability exists in io_init_req() when a ring is configured with IORING_SETUP_SQE_MIXED but without IORING_SETUP_NO_SQARRAY. The original check used the logical SQ head position (ctx->cached_sq_head) to guard 128-byte operations, which is only valid when physical and logical indices are identical. When sq_array is present, an unprivileged attacker can map any logical position to an arbitrary physical index. By setting sq_array[N] = sq_entries - 1, the attacker places a 128-byte operation at the final physical slot, causing io_uring_cmd_sqe_copy() to read 64 bytes beyond the allocated SQE array. The fix validates the physical SQE index directly: (unsigned)(sqe - ctx->sq_sqes) >= ctx->sq_entries - 1, correctly covering both sq_array and NO_SQARRAY configurations.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.19 | 6.19.9 | 1f794f9bed3e |
| mainline | 7.0 | 6f02c6b19603 |