CVE-2025-40291

An integer truncation vulnerability was found in the io_uring subsystem of the Linux kernel. The io_estimate_bvec_size() function can calculate a segment count that overflows when stored in an int, leading to undersized buffer allocations and subsequent memory corruption.

io_uring is a high-performance async I/O interface that local users can access. Exploitation requires crafting specific buffer registrations that trigger the overflow, which could lead to heap corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.