LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38730: io_uring/net: commit partial buffers on retry

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid. 2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer. Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux io_uring networking flaw can cause two receive operations to use the same application memory or retain an invalid buffer reference. A local, low-privileged attacker could potentially cause data corruption, information exposure, or system disruption. Risk depends on affected kernels and workloads using ring-provided buffers under partial receive conditions.

Executive priority

Treat this as a high-priority local kernel issue, particularly on shared compute, hosting, development, or container platforms where untrusted users can execute code. Patch through supported vendor channels after compatibility testing. Internet exposure alone does not establish vulnerability because the documented attack vector is local.

Technical view

During partial network receives, io_uring could retain a ring-provided buffer across retries. If the buffer ring is later unregistered, the request may reference invalid metadata. When sockets share a buffer group, multiple receives may instead target the same userspace buffer. The kernel fix prevents partial retries from pinning these buffers across execution contexts.

Likely exposure

Exposure requires an affected Linux kernel and io_uring networking workloads using ring-provided buffers. Relevant conditions include MSG_WAITALL or streaming sockets processing insufficient data, especially when buffer groups are shared or unregistered between retries. The supplied affected-version data includes 6.4, 6.6.103, 6.12.44, 6.15.11, 6.16.2, and 6.17, but should be confirmed against vendor advisories.

Exploitation context

The CVSS vector describes local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The supplied record is not in KEV, and the sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The vulnerability concerns buffer lifetime and ownership across io_uring receive retries. Potential outcomes include overlapping userspace receives and invalid buffer-list references. The supplied version representation is incomplete or ambiguous, including an unexplained "0" entry and commit identifiers; determine exposure using vendor package mappings and the referenced stable commits rather than version strings alone.

Mitigation direction

  • Check distribution or kernel-vendor guidance for affected packages and approved updates.
  • Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
  • Prioritize multi-user systems and hosts running untrusted or shared local workloads.
  • Where updates are delayed, assess whether affected io_uring networking features can be safely avoided.

Validation and detection

  • Record running kernel versions and distribution package revisions across Linux systems.
  • Compare vendor package changelogs or kernel sources with the referenced stable fix commits.
  • Identify workloads using io_uring networking and ring-provided buffer groups.
  • Review applications for MSG_WAITALL, streaming receives, shared buffer groups, or buffer-ring unregistration.
  • After updating, verify the running kernel and repeat relevant application regression tests.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38730 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38730Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc56e022c0a27142b7b59ae6bdf45f86bf4b298a1, c56e022c0a27142b7b59ae6bdf45f86bf4b298a1, c56e022c0a27142b7b59ae6bdf45f86bf4b298a1, c56e022c0a27142b7b59ae6bdf45f86bf4b298a1, c56e022c0a27142b7b59ae6bdf45f86bf4b298a1unaffected
LinuxLinux6.4, 0, 6.6.103, 6.12.44, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.