CVE-2026-31774

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()

sqe->len is __u32 but gets stored into sr->len which is int. When

userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF),

sr->len overflows to a negative value. This negative value propagates

through the bundle recv/send path:

1. io_recv(): sel.val = sr->len (ssize_t gets -1)

2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets

0xFFFFFFFFFFFFFFFF)

3. io_ring_buffers_peek(): buf->len is not clamped because max_len

is astronomically large

4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs()

5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1,

causing ret to increase instead of decrease, creating an

infinite loop that reads past the allocated iov[] array

This results in a slab-out-of-bounds read in io_bundle_nbufs() from

the kmalloc-64 slab, as nbufs increments past the allocated iovec

entri

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References