CVE-2025-39816
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-16

Last updated on: 2026-04-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-16
Last Modified
2026-04-11
Generated
2026-05-07
AI Q&A
2025-09-16
EPSS Evaluated
2026-05-05
NVD
CVE-2025-39816
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.12 (inc) to 6.12.49 (exc)
linux linux_kernel From 6.13 (inc) to 6.16.5 (exc)
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's io_uring/kbuf involves improper handling of buffer lengths provided by userspace. The issue arises because the buffer lengths were not always read atomically, which could lead to inconsistent or changing values during processing. The fix ensures that READ_ONCE() is used to read the buffer length into a local variable to guarantee a stable and consistent read. Additionally, the commit loop for the incremental ring buffer now stops if it encounters a zero-sized buffer, preventing further processing errors.


How can this vulnerability impact me? :

This vulnerability could lead to incorrect processing of buffer lengths in the io_uring interface, potentially causing unexpected behavior such as data corruption, crashes, or security issues due to inconsistent buffer size reads. Since the buffers are mapped from userspace, improper handling might allow attackers to exploit race conditions or inconsistent state, impacting system stability or security.


What immediate steps should I take to mitigate this vulnerability?

Update the Linux kernel to a version where this vulnerability is resolved. The fix involves using READ_ONCE() to safely read ring buffer lengths in io_uring/kbuf, ensuring stable reads and preventing issues with buffer length changes. Applying the latest kernel patches or updates that include this fix is the recommended mitigation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart