Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-40291

io_uring: fix regbuf vector size truncation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 to < 826ce37a842633efe1bb763e4b13045d74060d72affected
  • 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 to < 146eb58629f45f8297e83d69e64d4eea4b28d972affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.17.8 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References