CVE-2025-40046: io_uring/zcrx: fix overshooting recv limit
In the Linux kernel, the following vulnerability has been resolved:
iouring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was requested. It's caused by iozcrxrecvskb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40046?
CVE-2025-40046 has a moderate severity level due to its potential to allow overshooting of received limits.
How do I fix CVE-2025-40046?
To fix CVE-2025-40046, upgrade to the patched version of the Linux Kernel that addresses this vulnerability.
What types of systems are affected by CVE-2025-40046?
CVE-2025-40046 affects systems running the Linux Kernel that utilize io_uring functionality.
Can CVE-2025-40046 lead to data loss?
Yes, CVE-2025-40046 could potentially lead to data loss as it allows for receiving more data than intended.
Is CVE-2025-40046 actively exploited?
There are no current reports confirming active exploitation of CVE-2025-40046 in the wild.