CVE-2025-40216

Vulnerability

In the Linux kernel's io_uring subsystem, the rsrc (resource) handling code assumed a certain alignment of user virtual addresses when coalescing pages into folios. However, user pointers are not guaranteed to be aligned, and the offset calculation logic relied on flawed bitmask operations, as described in the CVE description [1].

Exploitation

An attacker with the ability to submit io_uring requests with unaligned user addresses can trigger incorrect page offset computations. This may lead to accessing unintended memory regions within a folio. No special privileges beyond being able to use io_uring are required, though the attack surface is local.

Impact

Successful exploitation could result in memory corruption, potentially leading to a denial of service or escalation of privileges. The exact impact depends on the specific kernel configuration and usage patterns.

Mitigation

The fix was applied in commit 50998b0ae7d9 and backported to stable kernels [2]. Users should update to the latest kernel versions containing this patch.