Out-of-bounds read in Linux kernel - CVE-2026-43006

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in io_import_fixed() when processing a zero-length fixed buffer import. A local user can submit a specially crafted io_uring request to disclose sensitive information.

The issue is triggered when the buffer address is accepted at the exact end of a registered region with a zero length.

Affected software

How to mitigate CVE-2026-43006

External References

• https://git.kernel.org/stable/c/040a1e7e0e2f01851fec1dd2d96906f8636a9f75
• https://git.kernel.org/stable/c/111a12b422a8cfa93deabaef26fec48237163214
• https://git.kernel.org/stable/c/40170fc1a79c1b2e68f09ae6aac687b7305ae6f4

Related Security Bulletins

• Out-of-bounds read in Linux kernel io_uring