CVE-2026-81009

Received Received - Intake

Linux Kernel Memory Corruption via io_uring Query

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81009

EUVD

EUVD-2026-76332

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of user-provided sizes during io_uring operations. The function io_handle_query_entry() clamps the size for copying data from user space but retains the original user value. When this value is used in copy_struct_to_user(), it can trigger a clear_user() operation that zeroes out up to nearly 4 GiB of memory, including on error paths where the result size is zero. The issue is reachable without a ring via IORING_REGISTER_QUERY.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and does not have a direct network detection method. To check if your system is vulnerable, verify the kernel version and io_uring implementation. Use commands like 'uname -a' to check the kernel version and 'grep -i io_uring /proc/kallsyms' to confirm io_uring is enabled. If your kernel version is older than the patched version, the system may be vulnerable.

Impact Analysis

This vulnerability could allow an attacker to cause significant memory corruption by zeroing out large portions of kernel memory. This may lead to system crashes, denial of service, or potentially privilege escalation if exploited. Systems using vulnerable Linux kernel versions are at risk.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version to resolve this issue. If updating is not immediately possible, consider disabling io_uring functionality by setting 'kernel.io_uring_disabled=1' via sysctl or removing io_uring modules. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-81009. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70