CVE-2026-43006: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)

Засегнати продукти

• Linux Linux: 8622b20f23ed165f48b8ca61503a107d17f8d585 преди 040a1e7e0e2f01851fec1dd2d96906f8636a9f75; 8622b20f23ed165f48b8ca61503a107d17f8d585 преди 40170fc1a79c1b2e68f09ae6aac687b7305ae6f4; 8622b20f23ed165f48b8ca61503a107d17f8d585 преди 111a12b422a8cfa93deabaef26fec48237163214
• Linux Linux: 6.15; преди 6.15; 6.18.22 до 6.18.*; 6.19.12 до 6.19.*; от 7.0 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-43006
• https://nvd.nist.gov/vuln/detail/CVE-2026-43006
• https://git.kernel.org/stable/c/040a1e7e0e2f01851fec1dd2d96906f8636a9f75
• https://git.kernel.org/stable/c/40170fc1a79c1b2e68f09ae6aac687b7305ae6f4
• https://git.kernel.org/stable/c/111a12b422a8cfa93deabaef26fec48237163214