CVE-2025-40046

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s io uring/zcrx functionality where a zcrx request can sometimes receive more data than requested. This occurs because the io zcrx recv skb() function adjusts the descriptor count (desc->count) for all received buffers, including fragment lists, and then makes recursive calls to process fragment list SKBs. This leads to double-accounting and potential underflow of the descriptor count.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.