CVE-2026-43006: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43006 is an out-of-bounds read vulnerability in the Linux kernel's io_uring subsystem, specifically in the resource (rsrc) management code responsible for fixed buffer imports. The flaw arises because validate_fixed_range() incorrectly permits a zero-length buffer address at the exact end of a registered memory region, leading to an out-of-bounds slab memory read in io_import_fixed(). Affected kernel versions include 6.15 through 6.18.21 (fixed in 6.18.22), 6.19 through 6.19.11 (fixed in 6.19.12), and 7.0-rc1 through 7.0-rc6. It was published on May 1, 2026, with patches available shortly after. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-805 (Buffer Access with Incorrect Length Value). In validate_fixed_range(), the boundary check uses a strict greater-than comparison (buf_end > imu->ubuf + imu->len), which inadvertently allows a buf_addr positioned at the exact end of the registered region when len is zero. When io_import_fixed() subsequently computes offset == imu->len, the bio_vec skip logic advances past the last valid bio_vec entry and reads bv_offset from out-of-bounds slab memory. The fix adds an early return from io_import_fixed() when len is zero, since a zero-length import has no data to transfer and must not traverse the bvec array. Exploitation requires local access with low privileges via the io_uring interface (io_uring_enter syscall) (Github Advisory, Red Hat Bugzilla).

A local attacker with low privileges who has access to io_uring operations can trigger this vulnerability by submitting a zero-length fixed buffer import at the boundary of a registered memory region, causing the kernel to read 4 bytes from adjacent out-of-bounds slab memory. This results in a high confidentiality impact (potential disclosure of sensitive kernel heap data) and high availability impact (kernel crash/instability via KASAN-detected slab-out-of-bounds access), with no integrity impact. The vulnerability is confined to the local system and does not directly enable lateral movement, but kernel memory disclosure could facilitate privilege escalation chaining (Github Advisory, Red Hat).

No public proof-of-concept exploit code is known to be available, and there is no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (3rd percentile), indicating a low near-term exploitation probability. The bug was identified with a task named poc/103 in the KASAN trace, suggesting internal or researcher-level testing occurred during discovery (Github Advisory, Red Hat Bugzilla).

1. Prerequisite: Obtain a local user account with access to the io_uring interface on a vulnerable Linux kernel (versions 6.15–6.18.21, 6.19–6.19.11, or 7.0-rc1 through 7.0-rc6). Confirm io_uring is not restricted via sysctl kernel.io_uring_disabled.
2. Register a fixed buffer: Use io_uring_register() with IORING_REGISTER_BUFFERS to register a memory region, establishing the imu (io_mapped_ubuf) structure with a known ubuf base address and len.
3. Craft a zero-length fixed write SQE: Prepare a submission queue entry (SQE) for IORING_OP_WRITE_FIXED targeting the registered buffer, setting the buffer address (buf_addr) to exactly imu->ubuf + imu->len (the end of the registered region) and the length (len) to zero.
4. Submit the SQE: Call io_uring_enter() to submit the crafted SQE. The validate_fixed_range() check passes because buf_end == imu->ubuf + imu->len satisfies the strict greater-than condition when len is zero.
5. Trigger out-of-bounds read: io_import_fixed() computes offset == imu->len, causing the bvec skip logic to advance past the last valid bio_vec entry and read bv_offset from 12 bytes beyond the allocated slab region, disclosing kernel heap memory contents (Red Hat Bugzilla, Github Advisory).

• Logs: Kernel logs (dmesg) showing BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 with a read of size 4 at an address 12 bytes past an allocated slab region; call stack entries including io_write_fixed, __io_issue_sqe, io_submit_sqes, and __do_sys_io_uring_enter.
• Process: Unusual processes making repeated io_uring_enter syscalls with zero-length fixed buffer operations; processes named poc or similar test harness names appearing in kernel traces.
• Kernel: KASAN reports referencing io_import_reg_buf or io_import_fixed with out-of-bounds addresses in the slab allocator region.

Patches are available in Linux kernel versions 6.18.22, 6.19.12, and 7.0 (stable). Red Hat Enterprise Linux 10 users should apply errata RHSA-2026:21557, which addresses this issue (Red Hat Bugzilla, Red Hat). As a workaround where patching is not immediately possible, administrators can restrict unprivileged access to io_uring by setting sysctl -w kernel.io_uring_disabled=1 (disables io_uring entirely) or kernel.io_uring_disabled=2 (restricts to privileged users only), reducing the attack surface since exploitation requires low-privilege local access.