CVE-2025-40291 (GCVE-0-2025-40291)
Vulnerability from cvelistv5
Published
2025-12-08 00:46
Modified
2026-08-05 12:09
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5
Version: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "826ce37a842633efe1bb763e4b13045d74060d72",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            },
            {
              "lessThan": "146eb58629f45f8297e83d69e64d4eea4b28d972",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix regbuf vector size truncation\n\nThere is a report of io_estimate_bvec_size() truncating the calculated\nnumber of segments that leads to corruption issues. Check it doesn\u0027t\noverflow \"int\"s used later. Rough but simple, can be improved on top."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through io_uring SQE submission (READV_FIXED/WRITEV_FIXED, zerocopy sendmsg, fixed uring_cmd), a local syscall interface; there is no remote network trigger despite one caller being in net.c.\nAC:L - The attacker fully controls the registered buffer and the iovec lengths that drive the truncated size estimate, so the under-allocation and out-of-bounds write are triggered deterministically with no race or uncontrolled condition.\nPR:L - Any unprivileged local user can create an io_uring instance and register buffers; io_uring is enabled by default (sysctl_io_uring_disabled=0) and requires no capabilities.\nUI:N - The attacker triggers the flaw entirely through their own io_uring operations with no victim interaction required.\nS:U - The corruption occurs within kernel heap memory in the same security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The integer-truncation-driven heap out-of-bounds access corrupts adjacent kernel objects and can be leveraged for arbitrary kernel-memory disclosure.\nI:H - The under-sized bvec allocation causes an out-of-bounds write of attacker-influenced bio_vec structures past the buffer, giving a heap write primitive exploitable for control-flow hijacking.\nA:H - The out-of-bounds heap write reliably corrupts kernel memory, causing oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:17.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/826ce37a842633efe1bb763e4b13045d74060d72"
        },
        {
          "url": "https://git.kernel.org/stable/c/146eb58629f45f8297e83d69e64d4eea4b28d972"
        }
      ],
      "title": "io_uring: fix regbuf vector size truncation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40291",
    "datePublished": "2025-12-08T00:46:14.601Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-08-05T12:09:17.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.