Linux Kernel io_uring 128-Byte SQE Bound Check Vulnerability
CVE-2026-43442 Published on May 8, 2026
io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY,
the boundary check for 128-byte SQE operations in io_init_req()
validated the logical SQ head position rather than the physical SQE
index.
The existing check:
!(ctx->cached_sq_head & (ctx->sq_entries - 1))
ensures the logical position isn't at the end of the ring, which is
correct for NO_SQARRAY rings where physical == logical. However, when
sq_array is present, an unprivileged user can remap any logical
position to an arbitrary physical index via sq_array. Setting
sq_array[N] = sq_entries - 1 places a 128-byte operation at the last
physical SQE slot, causing the 128-byte memcpy in
io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE
array.
Replace the cached_sq_head alignment check with a direct validation
of the physical SQE index, which correctly handles both sq_array and
NO_SQARRAY cases.
Products Associated with CVE-2026-43442
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1cba30bf9fdd6c982708f3587f609a30c370d889 and below 1f794f9bed3e5cf7250a3b4daf112a72ed1513e9 is affected.
- Version 1cba30bf9fdd6c982708f3587f609a30c370d889 and below 6f02c6b196036dbb6defb4647d8707d29b7fe95b is affected.
- Version 6.19 is affected.
- Before 6.19 is unaffected.
- Version 6.19.9, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.