CVE-2026-31484

Vulnerability

In the Linux kernel's io_uring subsystem, the __io_uring_show_fdinfo() function iterates over pending Submission Queue Entries (SQEs) to display information via /proc/self/fdinfo/<fd>. For rings configured with IORING_SETUP_SQE_MIXED, which allows 128-byte SQEs, the code must detect when the second half of a 128-byte SQE would exceed the bounds of the sq_sqes array. The original wrap check used (++sq_head & sq_mask) == 0, but sq_head is only incremented when a 128-byte SQE is encountered, not on every iteration. Consequently, the actual array index sq_idx = (i + sq_head) & sq_mask can equal sq_mask (the last slot) while the wrap check incorrectly passes, leading to an out-of-bounds read [1][2].

Exploitation

An attacker with the ability to create an io_uring instance with IORING_SETUP_SQE_MIXED and submit 128-byte SQEs can trigger this bug. The out-of-bounds read occurs when a user or process reads the fdinfo file for the io_uring file descriptor. No special privileges beyond the ability to create and use io_uring are required, but local access to the system is necessary.

Impact

The out-of-bounds read can leak sensitive kernel memory beyond the sq_sqes array. This information disclosure may reveal pointers, slab data, or other kernel structures, potentially aiding further exploitation. The vulnerability is rated High with a CVSS v3 score of 7.1.

Mitigation

The fix, which directly checks sq_idx instead of relying on the flawed wrap condition, has been backported to stable kernel trees [1][2]. Users should apply the latest kernel updates from their distribution. No workaround is available; updating the kernel is the recommended action.