CVE-2025-38730

A flaw was found in the Linux kernel's io_uring/net component. This vulnerability arises when ring provided buffers are partially committed during network operations, particularly when MSG_WAITALL is enabled or with streaming sockets. A local attacker could exploit this by causing multiple socket receives to access the same memory, leading to data corruption within applications. This could also result in system instability if buffer rings are unregistered before a retry operation completes.

This Moderate impact flaw in the Linux kernel's io_uring/net component affects Red Hat Enterprise Linux 9 and 10. A local attacker with a special group privilege may impact to a denial of service or a leak of kernel internal information through the shared ring buffer between user space and the kernel space processes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.