CVE-2025-38730: io_uring/net: commit partial buffers on retry
In the Linux kernel, the following vulnerability has been resolved:
io_uring/net: commit partial buffers on retry
Ring provided buffers are potentially only valid within the single
execution context in which they were acquired. io_uring deals with this
and invalidates them on retry. But on the networking side, if
MSG_WAITALL is set, or if the socket is of the streaming type and too
little was processed, then it will hang on to the buffer rather than
recycle or commit it. This is problematic for two reasons:
1) If someone unregisters the provided buffer ring before a later retry,
then the req->buf_list will no longer be valid.
2) If multiple sockers are using the same buffer group, then multiple
receives can consume the same memory. This can cause data corruption
in the application, as either receive could land in the same
userspace buffer.
Fix this by disallowing partial retries from pinning a provided buffer
across multiple executions, if ring provided buffers are used.
Security readout for executives and security teams
Plain-English summary
A Linux io_uring networking flaw can cause two receive operations to use the same application memory or retain an invalid buffer reference. A local, low-privileged attacker could potentially cause data corruption, information exposure, or system disruption. Risk depends on affected kernels and workloads using ring-provided buffers under partial receive conditions.
Executive priority
Treat this as a high-priority local kernel issue, particularly on shared compute, hosting, development, or container platforms where untrusted users can execute code. Patch through supported vendor channels after compatibility testing. Internet exposure alone does not establish vulnerability because the documented attack vector is local.
Technical view
During partial network receives, io_uring could retain a ring-provided buffer across retries. If the buffer ring is later unregistered, the request may reference invalid metadata. When sockets share a buffer group, multiple receives may instead target the same userspace buffer. The kernel fix prevents partial retries from pinning these buffers across execution contexts.
Likely exposure
Exposure requires an affected Linux kernel and io_uring networking workloads using ring-provided buffers. Relevant conditions include MSG_WAITALL or streaming sockets processing insufficient data, especially when buffer groups are shared or unregistered between retries. The supplied affected-version data includes 6.4, 6.6.103, 6.12.44, 6.15.11, 6.16.2, and 6.17, but should be confirmed against vendor advisories.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The supplied record is not in KEV, and the sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerability concerns buffer lifetime and ownership across io_uring receive retries. Potential outcomes include overlapping userspace receives and invalid buffer-list references. The supplied version representation is incomplete or ambiguous, including an unexplained "0" entry and commit identifiers; determine exposure using vendor package mappings and the referenced stable commits rather than version strings alone.
Mitigation direction
Check distribution or kernel-vendor guidance for affected packages and approved updates.
Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
Prioritize multi-user systems and hosts running untrusted or shared local workloads.
Where updates are delayed, assess whether affected io_uring networking features can be safely avoided.
Validation and detection
Record running kernel versions and distribution package revisions across Linux systems.
Compare vendor package changelogs or kernel sources with the referenced stable fix commits.
Identify workloads using io_uring networking and ring-provided buffer groups.
Review applications for MSG_WAITALL, streaming receives, shared buffer groups, or buffer-ring unregistration.
After updating, verify the running kernel and repeat relevant application regression tests.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-38730 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
6Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.