CVE-2026-31774

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring network component where a slab-out-of-bounds read can occur in the io bundle nbufs() function. This happens when userspace provides a sqe->len value exceeding INT MAX, causing sr->len to overflow into a negative value. This negative value propagates through the receive and send paths, specifically affecting io recv(), io recv buf select(), and io ring buffers peek(). Consequently, an infinite loop is created in io bundle nbufs() that reads past the allocated iov[] array from the kmalloc-64 slab.

Recommendations Reject negative sr->len values early in the io sendmsg prep() and io recvmsg prep() functions.