CVE-2026-43006

Vulnerability

CVE-2026-43006 is a slab-out-of-bounds read in the Linux kernel's io_uring subsystem. The vulnerability arises in io_import_fixed(), which processes fixed-buffer imports for I/O operations. When a user submits a zero-length buffer import (len == 0), the function validate_fixed_range() incorrectly allows the buffer address at the exact end of a registered region. This causes io_import_fixed() to compute an offset equal to the registered region's length (imu->len), and then the bvec skip logic advances past the last valid bio_vec entry, reading bv_offset from out-of-bounds slab memory [1].

Exploitation

An attacker must have the ability to submit io_uring IOCTL calls, which typically requires local user access with permissions to open /dev/io_uring and register fixed buffers. No special privileges beyond those needed for using io_uring are required. The attack surface is local; a remote attacker cannot directly exploit this without local shell access. The exploit triggers the out-of-bounds read via carefully crafted io_uring submission queue entries (SQEs) that specify zero-length fixed-buffer reads or writes [1].

Impact

Successful exploitation results in a KASAN-detected slab-out-of-bounds read, which can leak sensitive kernel memory contents (including slab data) or cause a kernel crash (denial of service) [1]. The vulnerability is rated HIGH (CVSS 7.1) reflecting the potential for information disclosure or system instability.

Mitigation

The fix, committed to the Linux kernel stable branches, adds an early return from io_import_fixed() when len is zero, preventing the out-of-bounds bvec access [1]. System administrators should apply the updated kernel packages as soon as they are available for their distribution. No workaround exists other than restricting local access to io_uring (e.g., via seccomp or LSM policies).