CVE-2026-81009

kernel: io_uring/query: cap user size passed to copy_struct_to_user

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · September 11, 2026

Updated · September 29, 2026

Description

A flaw was found in the Linux kernel. The io_uring/query interface, specifically within the io_handle_query_entry() function, does not properly cap the user-provided size when zeroing memory. A local attacker can exploit this by sending a specially crafted query that requests an excessively large amount of memory, up to 4 Gigabytes (GiB), to be zeroed. This can lead to a Denial of Service (DoS) due to the system performing extensive memory operations.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 · Allocation of Resources Without Limits or Throttling