CVE-2026-43442: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
In the Linux kernel, the following vulnerability has been resolved:
iouring: fix physical SQE bounds check for SQEMIXED 128-byte ops
When IORINGSETUPSQEMIXED is used without IORINGSETUPNOSQARRAY, the boundary check for 128-byte SQE operations in ioinitreq() validated the logical SQ head position rather than the physical SQE index.
The existing check:
!(ctx->cachedsqhead & (ctx->sqentries - 1))
ensures the logical position isn't at the end of the ring, which is correct for NOSQARRAY rings where physical == logical. However, when sqarray is present, an unprivileged user can remap any logical position to an arbitrary physical index via sqarray. Setting sqarray[N] = sqentries - 1 places a 128-byte operation at the last physical SQE slot, causing the 128-byte memcpy in iouringcmdsqecopy() to read 64 bytes past the end of the SQE array.
Replace the cachedsqhead alignment check with a direct validation of the physical SQE index, which correctly handles both sqarray and NOSQARRAY cases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel io_uringto a version that resolves this vulnerability.Patch io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops - Configuration
Ensure io_uring instances that use IORING_SETUP_SQE_MIXED without IORING_SETUP_NO_SQARRAY are updated/fixed; the resolved change replaces the cached_sq_head alignment check with direct validation for NO_SQARRAY cases so physical SQE bounds are checked correctly.
io_uring IORING_SETUP_SQE_MIXED / IORING_SETUP_NO_SQARRAY = Use IORING_SETUP_NO_SQARRAY when needed (NO_SQARRAY rings handled by physical==logical) - Compensating control
For systems where io_uring is exposed to unprivileged users, limit who can create io_uring instances (so users cannot remap logical sq_array entries to target physical SQE indices via the sq_array boundary-check bug).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43442?
CVE-2026-43442 has a high severity due to potential exploitation of the bounds check issue in io_uring.
How do I fix CVE-2026-43442?
To fix CVE-2026-43442, update your Linux kernel to the latest version where this vulnerability has been patched.
What versions of the Linux kernel are affected by CVE-2026-43442?
CVE-2026-43442 affects certain versions of the Linux kernel that use IORING_SETUP_SQE_MIXED without IORING_SETUP_NO_SQARRAY.
What kind of attacks can exploit CVE-2026-43442?
CVE-2026-43442 can potentially lead to unauthorized memory access or application crashes due to improper bounds checking.
Is CVE-2026-43442 related to io_uring performance?
Yes, CVE-2026-43442 is related to performance optimizations in io_uring that are impacted by the faulty bounds check.