Linux Kernel CVE-2026-43442

This vulnerability affects the io_uring asynchronous I/O subsystem introduced in Linux kernel 5.1, specifically the SQE (Submission Queue Entry) handling logic when using the IORING_SETUP_SQE_MIXED flag with submission queue arrays. The io_uring interface allows user space to submit I/O operations through a shared ring buffer. When IORING_SETUP_SQE_MIXED is configured without IORING_SETUP_NO_SQARRAY, applications can use 128-byte extended SQE operations alongside standard 64-byte entries. The vulnerable code path occurs in io_init_req() where boundary validation checks the logical cached_sq_head position rather than the physical SQE index derived from the user-controlled sq_array mapping. This architectural mismatch allows an attacker to manipulate the sq_array indirection table to place a 128-byte operation at the final physical slot, causing io_uring_cmd_sqe_copy() to read 64 bytes beyond the allocated SQE buffer during its memcpy operation. The affected CPE strings indicate this impacts general Linux kernel distributions starting from commit 1cba30bf9fdd6c982708f3587f609a30c370d889 in the 6.19 development cycle.