SB2026050889 - Out-of-bounds read in Linux kernel io_uring

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-43442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in io_uring_cmd_sqe_copy() when processing 128-byte SQE operations with IORING_SETUP_SQE_MIXED enabled and sq_array present. A local user can remap a logical submission queue position to the last physical SQE slot via sq_array to disclose sensitive information.

The issue occurs because the boundary check validated the logical SQ head position instead of the physical SQE index.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f794f9bed3e5cf7250a3b4daf112a72ed1513e9
• https://git.kernel.org/stable/c/6f02c6b196036dbb6defb4647d8707d29b7fe95b