CVE-2026-81009: io_uring/query: cap user size passed to copy_struct_to_user
In the Linux kernel, the following vulnerability has been resolved:
iouring/query: cap user size passed to copystructtouser
iohandlequeryentry() clamps hdr.size for the inbound copyfromuser() but keeps the original user value as usize. copystructtouser() uses that usize and, when it is larger than the kernel result, clearuser()s the trailing bytes.
As hdr.size is a u32, a query can request nearly 4 GiB of zeroing, including on the error path where ressize stays 0. The interface is reachable without a ring via IORINGREGISTERQUERY.
Reject sizes larger than PAGESIZE, as recommended for copystruct interfaces.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify io_handle_query_entry() to clamp hdr.size for the inbound copy_from_user(), and ensure copy_struct_to_user() rejects sizes larger than PAGE_SIZE so no trailing bytes are zeroed beyond the kernel result.
io_uring/query cap user size passed to copy_struct_to_user = Reject sizes larger than PAGE_SIZE (clamp hdr.size)
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to invoke the io_uring IORING_REGISTER_QUERY interface and supply an oversized user-controlled hdr.size value. No io_uring ring needs to be created, because the query interface is reachable without a ring.
What is the practical impact of supplying an oversized size?
A size approaching 4 GiB can cause copy_struct_to_user() to clear trailing user memory up to the supplied size. This can also occur on an error path when the result size remains zero, creating a potentially very large zeroing operation.
Is there a configuration-based mitigation if the fix cannot be applied immediately?
The provided information does not identify a configuration mitigation. The resolved behavior is to reject query sizes larger than PAGE_SIZE.
How can I determine whether a system includes the fix?
Check whether the kernel incorporates one of the referenced stable commits. The fix caps the user size used by the query operation and rejects sizes larger than PAGE_SIZE.