Home

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top.

PUBLISHED Reserved 2025-04-16 | Published 2025-12-08 | Updated 2025-12-08 | Assigner Linux

Product status

Default status
unaffected

9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 (git) before 826ce37a842633efe1bb763e4b13045d74060d72
affected

9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 (git) before 146eb58629f45f8297e83d69e64d4eea4b28d972
affected

Default status
affected

6.15
affected

Any version before 6.15
unaffected

6.17.8 (semver)
unaffected

6.18 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/826ce37a842633efe1bb763e4b13045d74060d72

git.kernel.org/...c/146eb58629f45f8297e83d69e64d4eea4b28d972

cve.org (CVE-2025-40291)

nvd.nist.gov (CVE-2025-40291)

Download JSON