CVE-2026-43006

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring subsystem where the validate fixed range() function allows a buffer address at the exact end of a registered region when the length is zero. This occurs because the check utilizes a strict greater-than comparison. Consequently, the io import fixed() function computes an offset equal to the registered length, causing the bvec skip logic to advance beyond the final bio vec entry and read bv offset from out-of-bounds slab memory. This can lead to a slab-out-of-bounds read in the io import reg buf() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.