Linux Kernel EUVD-2026-26605

The vulnerability resides in the io_uring subsystem's resource management code (io_uring/rsrc.c), specifically in the validate_fixed_range() and io_import_fixed() functions. io_uring is a high-performance asynchronous I/O interface introduced in Linux 5.1 that allows userspace applications to submit I/O operations through shared ring buffers. Fixed buffers are pre-registered memory regions that improve performance by avoiding repeated buffer registration overhead. The flaw occurs when validate_fixed_range() incorrectly permits a buffer address at the exact end of a registered region when length is zero (due to using strict greater-than comparison: buf_end > imu->ubuf + imu->len). This causes io_import_fixed() to compute offset == imu->len, which triggers the bio_vec (bvec) skip logic to advance past the last valid bio_vec entry in the array and dereference uninitialized slab memory to read bv_offset. The bio_vec structure is the kernel's representation of physically contiguous memory segments used for I/O operations. This is a classic off-by-one boundary condition combined with improper zero-length input validation.