io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()_CVE-2026-31774

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n\nsqe->len is __u32 but gets stored into sr->len which is int. When\nuserspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF),\nsr->len overflows to a negative value. This negative value propagates\nthrough the bundle recv/send path:\n\n  1. io_recv(): sel.val = sr->len (ssize_t gets -1)\n  2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets\n     0xFFFFFFFFFFFFFFFF)\n  3. io_ring_buffers_peek(): buf->len is not clamped because max_len\n     is astronomically large\n  4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs()\n  5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1,\n     causing ret to increase instead of decrease, creating an\n     infinite loop that reads past the allocated iov[] array\n\nThis results in a slab-out-of-bounds read in io_bundle_nbufs() from\nthe kmalloc-64 slab, as nbufs increments past the allocated iovec\nentries.\n\n  BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160\n  Read of size 8 at addr ffff888100ae05c8 by task exp/145\n  Call Trace:\n   io_bundle_nbufs+0x128/0x160\n   io_recv_finish+0x117/0xe20\n   io_recv+0x2db/0x1160\n\nFix this by rejecting negative sr->len values early in both\nio_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32,\nany value > INT_MAX indicates overflow and is not a valid length.",
    "published": "2026-05-01T14:15:02.903Z",
    "modified": "2026-05-03T05:45:55.126Z",
    "type": "cve",
    "title": "io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6\nhttps://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec\nhttps://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c\nhttps://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5",
    "id": "CVE-2026-31774",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux a05d1f625c7aa681d8816bc0f10089289ad07aad\nLinux Linux a05d1f625c7aa681d8816bc0f10089289ad07aad\nLinux Linux a05d1f625c7aa681d8816bc0f10089289ad07aad\nLinux Linux a05d1f625c7aa681d8816bc0f10089289ad07aad\nLinux Linux 6.10",
    "sourceHref": "",
    "cvss": {
        "score": 7.1,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "a05d1f625c7aa681d8816bc0f10089289ad07aad",
    "vendor": "Linux",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}