CVE-2026-43006

A flaw was found in the Linux kernel's io_uring subsystem. A local attacker can exploit a vulnerability in the io_import_fixed() function by importing a zero-length fixed buffer. This can lead to an out-of-bounds read from slab memory, potentially resulting in information disclosure or a denial of service.

A moderate-impact flaw was found in the Linux kernel's io_uring subsystem, affecting the kernel in Red Hat Enterprise Linux 10.2 and 10.3 and in Red Hat In-Vehicle OS 2.0. When a zero-length fixed buffer is imported, validate_fixed_range() incorrectly accepts a buffer address at the exact end of the registered region, so io_import_fixed() computes an offset equal to the registered buffer length. The bvec skip logic then advances past the last bio_vec entry and reads bv_offset from out-of-bounds kernel slab memory. A local attacker with low privileges can trigger this out-of-bounds read by submitting an io_uring operation that uses a zero-length registered fixed buffer, potentially resulting in limited disclosure of adjacent kernel slab memory contents or a denial of service. Earlier Red Hat Enterprise Linux releases (RHEL 6 through RHEL 10.1, including kernel-rt variants where shipped) are not affected because the code that introduced this flaw, first added upstream in Linux 6.15, is not present in those releases. Fixes for the affected releases are being pursued by the responsible engineering teams, and a fixed kernel for Red Hat Enterprise Linux 10.2 has already been released. Although the CVSS:3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) corresponds to an Important severity, Red Hat has rated the overall impact of this flaw as Moderate because the out-of-bounds access is limited to a small read immediately beyond a kernel slab allocation, which limits the practical confidentiality and availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can be mitigated by disabling the io_uring subsystem, which removes the attack vector. Setting the sysctl kernel.io_uring_disabled to 1 prevents unprivileged processes not in the io_uring_group group from creating new io_uring instances (io_uring_setup() fails with -EPERM), while setting it to 2 disables io_uring creation for all processes; io_uring instances created before the change remain usable. For example, run 'sysctl -w kernel.io_uring_disabled=1' and persist the setting in /etc/sysctl.d/ to survive reboots. This may impact applications that rely on io_uring for asynchronous I/O. As a permanent fix, update to a kernel package that contains the fix for the affected release.