CVE-2026-43006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rsrc: reject zero-length fixed buffer import

validate_fixed_range() admits buf_addr at the exact end of the

registered region when len is zero, because the check uses strict

greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed()

then computes offset == imu->len, which causes the bvec skip logic

to advance past the last bio_vec entry and read bv_offset from

out-of-bounds slab memory.

Return early from io_import_fixed() when len is zero. A zero-length

import has no data to transfer and should not walk the bvec array

at all.

BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0

Read of size 4 at addr ffff888002bcc254 by task poc/103

Call Trace:

io_import_reg_buf+0x697/0x7f0

io_write_fixed+0xd9/0x250

__io_issue_sqe+0xad/0x710

io_issue_sqe+0x7d/0x1100

io_submit_sqes+0x86a/0x23c0

__do_sys_io_uring_enter+0xa98/0x1590

Allocated by task 103:

The buggy address is loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References