Skip to main content

Linux Kernel CVE-2025-40046

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.6
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI
6.6 MEDIUM

io_uring zcrx is a local interface requiring a running unprivileged process to drive it, so AV:L/PR:L; overshoot leaks limited data (C:L/I:L) while counter underflow threatens kernel stability (A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:53 vuln.today
CVE Published
Oct 28, 2025 - 12:15 cve.org
HIGH 8.6

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix overshooting recv limit

It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.

AnalysisAI

Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.

Technical ContextAI

The vulnerability lives in io_uring's zcrx (zero-copy receive) subsystem, specifically io_zcrx_recv_skb(). io_uring is the Linux asynchronous I/O interface, and zcrx maps received network payloads directly into user-registered memory to avoid copies. The bug is a length/counter mismanagement class issue (closest CWE mapping is CWE-193 Off-by-one / CWE-191 Integer Underflow, though the input lists CWE as N/A): the code decrements desc->count for every received buffer, including those in a fragment list, but then recursively descends into frag-list skbs where the same bytes are accounted a second time. The double subtraction underflows the remaining-count value, defeating the check that should cap how much data a single recv delivers.

Affected ProductsAI

The affected product is the Linux kernel, specifically builds that include the io_uring zcrx zero-copy receive feature (a comparatively recent addition to io_uring). No exact vulnerable version range or CPE was provided in the input; the fix is delivered via the stable tree in commits 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 and 8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4f (https://git.kernel.org/stable/c/09cfd3c52ea76f43b3cb15e570aeddf633d65e80 and https://git.kernel.org/stable/c/8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4f). Exact affected version boundaries should be confirmed against the kernel changelog and each distribution's backport status.

RemediationAI

Upstream fix available (stable-tree commits 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 and 8bcc9eaf1b19f1a7029cba19f6bd4122b40f6c4f); a specific released/tagged kernel version was not provided and is not independently confirmed, so apply the kernel update from your distribution once it incorporates these commits (see https://git.kernel.org/stable/c/09cfd3c52ea76f43b3cb15e570aeddf633d65e80). As a compensating control until patched, restrict or disable access to io_uring for untrusted local workloads - for example set the sysctl kernel.io_uring_disabled=2 to block io_uring system-wide, or =1 to gate it behind the io_uring_group; note the trade-off that this breaks any legitimate application relying on io_uring (including zcrx-based high-performance networking). Where full disablement is too disruptive, limit which processes/containers are permitted io_uring via seccomp profiles.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40046 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy