UBUNTU-CVE-2026-81009: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry() clamps hdr.size for the inbound copyfromuser() but keeps the original user value as usize. copystructtouser() uses that usize and, when it is larger than the kernel result, clearuser()s the trailing bytes. As hdr.size is a u32, a query can request nearly 4 GiB of zeroing, including on the error path where ressize stays 0. The interface is reachable without a ring via IORINGREGISTERQUERY. Reject sizes larger than PAGESIZE, as recommended for copystruct interfaces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reject IORING_REGISTER_QUERY requests with user-supplied sizes larger than PAGE_SIZE before calling copy_struct_to_user().
Event History
Frequently Asked Questions
Who can reach the vulnerable interface?
The interface is reachable through IORING_REGISTER_QUERY without creating an io_uring ring. An attacker able to issue this io_uring registration request can supply the affected size field.
What input is required to trigger the issue?
The attacker supplies an oversized hdr.size value. Because the field is a 32-bit unsigned value, it can request nearly 4 GiB of trailing memory zeroing, including when the query follows an error path with a zero result size.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the remediation implemented by the fix?
The fix rejects query sizes larger than PAGE_SIZE before passing the user-supplied size to copy_struct_to_user().