CVE-2026-81009

In the Linux kernel, the following vulnerability has been resolved:

io uring/query: cap user size passed to copy struct to user

io handle query entry() clamps hdr.size for the inbound copy from user() but keeps the original user value as usize. copy struct to user() uses that usize and, when it is larger than the kernel result, clear user()s the trailing bytes.

As hdr.size is a u32, a query can request nearly 4 GiB of zeroing, including on the error path where res size stays 0. The interface is reachable without a ring via IORING REGISTER QUERY.

Reject sizes larger than PAGE SIZE, as recommended for copy struct * interfaces.