LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40046: io_uring/zcrx: fix overshooting recv limit

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw can let certain zero-copy network receive operations accept more data than requested. This boundary failure may disrupt affected systems and could expose or alter limited data. Availability is the primary concern. The supplied CVSS score is 8.6, but the sources provide no evidence of active exploitation.

Executive priority

Treat as a high-priority kernel update for systems using the affected receive path, especially network-facing or availability-critical services. Validate exposure promptly, but avoid declaring an emergency solely from the score because active exploitation is not evidenced and version-range details are incomplete.

Technical view

The io_uring zcrx receive path adjusts desc->count for every received buffer, including fragment lists, then recursively processes fragment-list socket buffers. This double-counts received data and can underflow the remaining count, allowing a request to exceed its receive limit. Two Linux stable-kernel fix commits are referenced.

Likely exposure

Exposure is limited to Linux systems running affected kernels and using the io_uring zcrx receive functionality. The supplied version markers include 6.15, 6.17.3, and 6.18, but their precise range relationships are unclear. Confirm applicability through Linux or distribution advisories before treating a host as vulnerable.

Exploitation context

The CVSS vector describes network reachability, low complexity, no required privileges, and no user interaction. However, the supplied sources do not document a public exploit, demonstrated attack, or active exploitation. The CVE is not listed as KEV in the bundle.

Researcher notes

The core invariant failure is desc->count underflow caused by accounting fragment-list buffers before recursive processing. Researchers should compare distribution backports with commits 8bcc9eaf1b19 and 09cfd3c52ea7. The bundle does not identify CWE mappings, exploitation prerequisites beyond CVSS, affected-range operators, or confirmed exploitability outcomes.

Mitigation direction

  • Check Linux distribution advisories for affected package versions and approved kernel updates.
  • Install a vendor-supported kernel containing the referenced stable fixes.
  • Prioritize internet-facing or availability-sensitive systems using io_uring zero-copy receive.
  • If immediate patching is impossible, assess whether the affected zcrx functionality can be safely avoided.

Validation and detection

  • Inventory running kernel and installed kernel package versions across Linux systems.
  • Determine whether workloads use io_uring zcrx receive functionality.
  • Verify the deployed kernel includes an applicable referenced fix or vendor backport.
  • Reboot after updating when required, then confirm the active kernel version.
  • Monitor affected services for receive-limit anomalies, crashes, or unexpected resource exhaustion.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40046 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.6High
CVSS 3.1 vector shape for CVE-2025-40046Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6699ec9a23f85f1764183430209c741847c45f12, 6699ec9a23f85f1764183430209c741847c45f12unaffected
LinuxLinux6.15, 0, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.