Riskcovery

CVE-2025-40046

io_uring/zcrx: fix overshooting recv limit

State
Published
Severity
8.6 High
Published
Oct 28, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix overshooting recv limit

It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.

Scores

CVSSScoreVectorSource
3.18.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6699ec9a23f85f1764183430209c741847c45f12 to before 8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4fAffected
  • 6699ec9a23f85f1764183430209c741847c45f12 to before 09cfd3c52ea76f43b3cb15e570aeddf633d65e80Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.17.3 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.