CVE-2025-38730

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: commit partial buffers on retry

Ring provided buffers are potentially only valid within the single

execution context in which they were acquired. io_uring deals with this

and invalidates them on retry. But on the networking side, if

MSG_WAITALL is set, or if the socket is of the streaming type and too

little was processed, then it will hang on to the buffer rather than

recycle or commit it. This is problematic for two reasons:

1) If someone unregisters the provided buffer ring before a later retry,

then the req->buf_list will no longer be valid.

2) If multiple sockers are using the same buffer group, then multiple

receives can consume the same memory. This can cause data corruption

in the application, as either receive could land in the same

userspace buffer.

Fix this by disallowing partial retries from pinning a provided buffer

across multiple executions, if ring provided buffers are use

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References