In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.
Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.
References
Configurations
Configuration 1 (hide)
|
History
02 Dec 2025, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/390a61d284e1ced088d43928dfcf6f86fffdd780 - Patch | |
| References | () https://git.kernel.org/stable/c/695673eb5711ee5eb1769481cf1503714716a7d1 - Patch | |
| References | () https://git.kernel.org/stable/c/98b6fa62c84f2e129161e976a5b9b3cb4ccd117b - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
Information
Published : 2025-09-16 13:15
Updated : 2025-12-02 19:04
NVD link : CVE-2025-39816
Mitre link : CVE-2025-39816
CVE.ORG link : CVE-2025-39816
JSON object : View
Products Affected
linux
- linux_kernel
CWE