CVE-2026-31774

Vulnerability

CVE-2026-31774 is a slab-out-of-bounds read vulnerability exists in the Linux kernel's io_uring subsystem, specifically in the io_bundle_nbufs() function. The root cause is a type mismatch: sqe->len is stored as a 32-bit unsigned integer (__u32) from the submission queue entry (sqe->len) but is later assigned to an int variable (sr->len). When a user passes a value larger than INT_MAX (e.g., 0xFFFFFFFF), the signed integer overflows to a negative value. This negative length propagates through the bundle receive/send path, leading to an infinite loop that reads beyond the allocated iovec array, resulting in a slab-out-of-bounds read from the kmalloc-64 slab [1][2][3][4].

Exploitation

An attacker with the ability to submit io_uring requests (requires the io_uring system call and appropriate permissions) can trigger this vulnerability by crafting a submission queue entry with a len field greater than INT_MAX. No additional authentication is needed beyond the ability to use io_uring. The negative length causes io_recv() to set sel.val to -1, which is then cast to a size_t in io_recv_buf_select(), resulting in an extremely large max_len. This bypasses length clamping in io_ring_buffers_peek(), allowing an oversized iov_len to reach io_bundle_nbufs(), where the min_t(int, ...) operation yields -1, causing the loop counter to increase indefinitely and read out-of-bounds [1].

Impact

Successful exploitation leads to a slab-out-of-bounds read, which can leak sensitive kernel memory contents could be exposed to the attacker. This can result in information disclosure, potentially leaking data from other processes or the kernel itself. The vulnerability is rated High with a CVSS v3 score of 7.1, indicating significant confidentiality impact [1].

Mitigation

The fix, already applied in the Linux kernel stable tree, rejects negative sr->len values early in both io_sendmsg_prep() functions for send and receive operations. Since sqe->len is unsigned, any value exceeding INT_MAX is invalid and is now rejected. Users should update to a kernel version containing the commit 1b655cd31134 or later [1][2][3][4]. No workaround is available; patching is required.