CVE-2026-43442
kernel: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
Loading…
Severity
ModerateRed Hat Product Security
CVSS
Review impact separately from score.
Published · May 8, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's io_uring subsystem. An incorrect bounds check for 128-byte Submission Queue Entry (SQE) operations, when IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, allows an unprivileged local user to remap logical SQE positions to arbitrary physical indices. This can lead to an out-of-bounds read, potentially disclosing sensitive information from kernel memory.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-805 · Buffer Access with Incorrect Length Value