CVE-2024-35827

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: fix overflow check in io_recvmsg_mshot_prep()

The Linux kernel CVE team has assigned CVE-2024-35827 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051741-CVE-2024-35827-822c@gregkh/T

This vulnerability is rated with a Low severity because it requires local access to craft specialized asynchronous I/O requests and primarily poses a denial of service risk. The flaw exists due to improper integer boundary checking within the kernel's io_uring subsystem when handling multishot network receive buffers. Standard Red Hat Enterprise Linux configurations do not expose multishot socket operations by default to unprivileged network services, and older enterprise releases lack the affected networking code entirely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.