Buffer Overflow Vulnerability in Linux Kernel Affects io_uring Functionality

CVE-2026-43006

What is CVE-2026-43006?

A vulnerability in the Linux kernel's io_uring feature has been identified, wherein a zero-length fixed buffer import is incorrectly handled. The validate_fixed_range() function allows a buffer address at the boundary of the registered region when the length is zero, leading to out-of-bounds memory access. This occurs due to inadequate checks, which permit the bvec skip logic to mistakenly advance past the last bio_vec entry, causing potential access to non-allocated memory. To mitigate this issue, the io_import_fixed() function must return early when the length is zero, as no data is available for transfer. This improper memory access scenario has been marked by KASAN, indicating a risk of data leakage or application crashes.

References