In the Linux kernel, the following vulnerability has been resolved:
io_uring/rsrc: reject zero-length fixed buffer import
validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory.
Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all.
BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Jun 3, 2026 | May 1, 2026 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-debuginfoUpgrade rtlaUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-uki-virtUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-uki-virtUpgrade perf-debuginfoUpgrade libperfUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-debug-modules-coreUpgrade rvUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-rtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-extra-matchedUpgrade libperf-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libsUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modules | Jun 8, 2026 | Jun 4, 2026 |
| Ubuntu | — | Upgrade linux-nvidia | May 25, 2026 | May 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub