CVE-2026-43006: io_uring/rsrc: reject zero-length fixed buffer import
In the Linux kernel, the following vulnerability has been resolved:
iouring/rsrc: reject zero-length fixed buffer import
validatefixedrange() admits bufaddr at the exact end of the registered region when len is zero, because the check uses strict greater-than (bufend > imu->ubuf + imu->len). ioimportfixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last biovec entry and read bvoffset from out-of-bounds slab memory.
Return early from ioimportfixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all.
BUG: KASAN: slab-out-of-bounds in ioimportregbuf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: ioimportregbuf+0x697/0x7f0 iowritefixed+0xd9/0x250 ioissuesqe+0xad/0x710 ioissuesqe+0x7d/0x1100 iosubmitsqes+0x86a/0x23c0 dosysiouringenter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the io_uring fixed-buffer import path to return early from io_import_fixed() when the import len is zero, so it does not walk the bvec array / registered region when there is no data to transfer.
Linux kernel io_uring (io_import_fixed / io_import_reg_buf / io_write_fixed) Return early from io_import_fixed() when len is zero = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43006?
CVE-2026-43006 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43006?
To fix CVE-2026-43006, upgrade to the latest version of the Linux kernel that addresses this vulnerability.
What components are affected by CVE-2026-43006?
CVE-2026-43006 specifically affects the io_uring component of the Linux kernel.
What does CVE-2026-43006 exploit?
CVE-2026-43006 exploits a flaw in the validate_fixed_range function that improperly handles zero-length fixed buffer imports.
Has CVE-2026-43006 been patched?
Yes, CVE-2026-43006 has been resolved in a subsequent release of the Linux kernel.