CVE-2026-43006: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43006 Overview

CVE-2026-43006 is an out-of-bounds read vulnerability in the Linux kernel io_uring subsystem. The flaw resides in validate_fixed_range(), which incorrectly admits a buf_addr at the exact end of a registered region when the length is zero. The check uses a strict greater-than comparison (buf_end > imu->ubuf + imu->len), allowing a zero-length fixed buffer import to pass validation. As a result, io_import_fixed() computes offset == imu->len, and the bvec skip logic advances past the last bio_vec entry and reads bv_offset from out-of-bounds slab memory.

Critical Impact
A local, low-privileged user can trigger a slab out-of-bounds read in kernel memory, leading to information disclosure or kernel panic and denial of service.

Affected Products

Linux kernel (io_uring/rsrc subsystem)
Distributions shipping vulnerable mainline and stable kernels prior to the fix commits
Workloads using io_uring with fixed (registered) buffers

Discovery Timeline

2026-05-01 - CVE-2026-43006 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-43006

Vulnerability Analysis

The io_uring subsystem allows user space to register fixed buffers for repeated I/O operations, avoiding per-request mapping overhead. Before each I/O, validate_fixed_range() verifies that the requested buffer slice lies within the registered region. The boundary check buf_end > imu->ubuf + imu->len uses strict greater-than, which permits buf_end == imu->ubuf + imu->len even when the request length is zero. A zero-length request positioned at the end of the region therefore passes validation.

The downstream function io_import_fixed() then derives offset = buf_addr - imu->ubuf, producing a value equal to imu->len. The bvec skip loop walks the scatter-gather list to locate the starting page, but the computed offset advances the iterator past the last valid bio_vec. Reading bv_offset from the next entry accesses memory beyond the allocated imu structure.

Kernel Address Sanitizer (KASAN) reports confirm the read: BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0, with a 4-byte read located 12 bytes past the end of a 584-byte slab allocation. The fix returns early from io_import_fixed() when len is zero, since a zero-length import has no data to transfer and must not walk the bvec array.

Root Cause

The root cause is an off-by-one boundary condition in validate_fixed_range() combined with missing handling of the zero-length edge case in io_import_fixed(). The strict greater-than comparison fails to reject buffers whose start address sits exactly at the end-of-region marker [CWE-125].

Attack Vector

Exploitation requires local access and the ability to submit io_uring SQEs. An attacker registers a fixed buffer, then issues a fixed-buffer read or write operation with len = 0 and buf_addr = imu->ubuf + imu->len. The malformed submission queue entry passes validation and triggers the out-of-bounds read inside io_import_reg_buf. The KASAN trace shows the path through io_write_fixed, __io_issue_sqe, io_issue_sqe, io_submit_sqes, and __do_sys_io_uring_enter.

The vulnerability is described in prose only; no public proof-of-concept code is referenced in the enriched data. See the upstream patches at kernel.org commit 040a1e7e, commit 111a12b4, and commit 40170fc1 for the verified fix.

Detection Methods for CVE-2026-43006

Indicators of Compromise

KASAN reports referencing io_import_reg_buf or io_import_fixed with slab-out-of-bounds reads
Kernel oops or panic traces originating from __do_sys_io_uring_enter followed by io_submit_sqes and io_write_fixed
Unexpected process crashes or kernel log entries from workloads invoking io_uring_register with fixed buffers

Detection Strategies

Enable KASAN on test and staging kernels to surface the out-of-bounds read deterministically
Audit auditd records for processes issuing io_uring_setup, io_uring_register, and io_uring_enter syscalls with anomalous parameters
Hunt for kernel ring-buffer entries (dmesg) containing the io_import_reg_buf symbol alongside KASAN or BUG markers

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging pipeline for retrospective analysis
Track running kernel versions across the fleet and flag hosts on unpatched stable branches
Monitor sudden increases in io_uring-related syscall failures or process terminations on multi-tenant hosts

How to Mitigate CVE-2026-43006

Immediate Actions Required

Apply the upstream stable kernel patches referenced by the three git.kernel.org commits and reboot affected systems
Inventory hosts running container, database, or proxy workloads that rely on io_uring fixed buffers and prioritize their patching
Restrict untrusted local users on shared systems until patched kernels are deployed

Patch Information

The fix returns early from io_import_fixed() when the request length is zero, eliminating the bvec walk for empty imports. Apply the stable kernel updates available at commit 040a1e7e, commit 111a12b4, and commit 40170fc1. Rebuild and redeploy distribution kernels that incorporate these commits.

Workarounds

Disable or restrict io_uring for unprivileged users by setting kernel.io_uring_disabled = 2 via sysctl on kernels that support the toggle
Use seccomp profiles to block the io_uring_setup, io_uring_register, and io_uring_enter syscalls for untrusted workloads
Constrain container runtimes with the default Docker or containerd seccomp profile, which already filters io_uring syscalls

bash

# Configuration example: disable io_uring for unprivileged users
sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled = 2' >> /etc/sysctl.d/99-harden-io_uring.conf