CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, the boundary check for 128-byte SQE operations in io_init_req() validated the logical SQ head position rather than the physical SQE index. The existing check: !(ctx->cached_sq_head & (ctx->sq_entries - 1)) ensures the logical position isn't at the end of the ring, which is correct for NO_SQARRAY rings where physical == logical. However, when sq_array is present, an unprivileged user can remap any logical position to an arbitrary physical index via sq_array. Setting sq_array[N] = sq_entries - 1 places a 128-byte operation at the last physical SQE slot, causing the 128-byte memcpy in io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE array. Replace the cached_sq_head alignment check with a direct validation of the physical SQE index, which correctly handles both sq_array and NO_SQARRAY cases.
Засегнати продукти
- Linux Linux: 1cba30bf9fdd6c982708f3587f609a30c370d889 преди 1f794f9bed3e5cf7250a3b4daf112a72ed1513e9; 1cba30bf9fdd6c982708f3587f609a30c370d889 преди 6f02c6b196036dbb6defb4647d8707d29b7fe95b
- Linux Linux: 6.19; преди 6.19; 6.19.9 до 6.19.*; от 7.0 нататък
История
- 8 май 2026 Публикувано