LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43006: io_uring/rsrc: reject zero-length fixed buffer import

In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user or workload can trigger an out-of-bounds kernel memory read through Linux io_uring fixed buffers. Successful abuse could expose kernel memory or crash the host. No user interaction is required, but remote-only attackers are not directly positioned to exploit it.

Executive priority

Treat as a high-priority kernel update for shared or untrusted-compute environments. It is less urgent for systems without local untrusted access, but potential kernel-memory disclosure and host crashes justify timely remediation. Confirm exact exposure with vendors because the supplied version boundaries are unclear.

Technical view

A zero-length fixed-buffer request at the registered region boundary passes range validation. io_import_fixed() calculates an offset equal to the region length, advances beyond the final bio_vec, and reads slab memory out of bounds. The published fix returns before walking the array when length is zero.

Likely exposure

Exposure requires an affected Linux kernel plus local, low-privileged access to the io_uring path. Multi-user systems and hosts running untrusted workloads deserve priority. The supplied affected-version data is ambiguous, so exact package exposure must be confirmed with the Linux distribution or kernel vendor.

Exploitation context

CVSS 3.1 is 7.1: local access, low complexity, low privileges, no user interaction, with potential high confidentiality and availability impact. The supplied record is not marked as CISA KEV, and the source bundle provides no evidence of active exploitation.

Researcher notes

The reported KASAN failure is a four-byte slab out-of-bounds read after bvec traversal advances beyond the allocation. The boundary condition requires a zero-length import whose address equals the registered region's end. The sources establish the defect and correction, but do not establish practical data recovery, reliable denial of service, or exploitation in the wild.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable listed stable fix.
  • Confirm the selected distribution package backports the zero-length io_import_fixed() correction.
  • If upgrading is delayed, obtain vendor-approved temporary mitigations; none are identified in the supplied sources.
  • Prioritize shared hosts and systems permitting untrusted local workloads.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Compare each kernel package against its distribution's CVE and backport guidance.
  • Verify deployed kernel sources or package changelogs include an applicable referenced commit.
  • Confirm systems booted into the corrected kernel after maintenance.
  • Monitor kernel diagnostics for io_import_reg_buf or slab-out-of-bounds events.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43006 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-43006Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8622b20f23ed165f48b8ca61503a107d17f8d585, 8622b20f23ed165f48b8ca61503a107d17f8d585, 8622b20f23ed165f48b8ca61503a107d17f8d585unaffected
LinuxLinux6.15, 0, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.