{"id":"CVE-2026-31774","title":"io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n\nsqe->len is __u32 but gets stored into sr->len which is int. When\nuserspace passes sqe->len values excee…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < 90ced24c500ad4e129e9e34b7e56fd7849e350b6","Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < c314b405dcc4d8b9041124f928f81715d6328bec","Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < 1b655cd311344117d3052f6552cb20d9901c9d7c","Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < b948f9d5d3057b01188e36664e7c7604d1c8ecb5","Linux 6.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:13:11.625324Z"},"published":"2026-05-01","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:26.861Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31774","references":[{"url":"https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6"},{"url":"https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec"},{"url":"https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c"},{"url":"https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5"}],"tags":["cve.org"],"epss":0.00166,"epssPercentile":0.05444,"ingestedAt":"2026-10-16T17:24:46.674Z","slug":"CVE-2026-31774","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n\nsqe->len is __u32 but gets stored into sr->len which is int. When\nuserspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF),\nsr->len overflows to a negative value. This negative value propagates\nthrough the bundle recv/send path:\n\n  1. io_recv(): sel.val = sr->len (ssize_t gets -1)\n  2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets\n     0xFFFFFFFFFFFFFFFF)\n  3. io_ring_buffers_peek(): buf->len is not clamped because max_len\n     is astronomically large\n  4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs()\n  5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1,\n     causing ret to increase instead of decrease, creating an\n     infinite loop that reads past the allocated iov[] array\n\nThis results in a slab-out-of-bounds read in io_bundle_nbufs() from\nthe kmalloc-64 slab, as nbufs increments past the allocated iovec\nentries.\n\n  BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160\n  Read of size 8 at addr ffff888100ae05c8 by task exp/145\n  Call Trace:\n   io_bundle_nbufs+0x128/0x160\n   io_recv_finish+0x117/0xe20\n   io_recv+0x2db/0x1160\n\nFix this by rejecting negative sr->len values early in both\nio_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32,\nany value > INT_MAX indicates overflow and is not a valid length.\n\n## Affected\n\n- `Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < 90ced24c500ad4e129e9e34b7e56fd7849e350b6`\n- `Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < c314b405dcc4d8b9041124f928f81715d6328bec`\n- `Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < 1b655cd311344117d3052f6552cb20d9901c9d7c`\n- `Linux >= a05d1f625c7aa681d8816bc0f10089289ad07aad < b948f9d5d3057b01188e36664e7c7604d1c8ecb5`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}