CVE-2026-43442

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops

When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY,

the boundary check for 128-byte SQE operations in io_init_req()

validated the logical SQ head position rather than the physical SQE

index.

The existing check:

!(ctx->cached_sq_head & (ctx->sq_entries - 1))

ensures the logical position isn't at the end of the ring, which is

correct for NO_SQARRAY rings where physical == logical. However, when

sq_array is present, an unprivileged user can remap any logical

position to an arbitrary physical index via sq_array. Setting

sq_array[N] = sq_entries - 1 places a 128-byte operation at the last

physical SQE slot, causing the 128-byte memcpy in

io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE

array.

Replace the cached_sq_head alignment check with a direct validation

of the physical SQE index, which correctly handles both sq_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References