Linux kernel io_uring: sqe->opcode used unsanitized for table lookups under speculative execution

CVSS 7.8CVE-2025-21863Kernel, userspace & hypervisorcurated

Impact

io_uring indexes several dispatch tables with sqe->opcode taken straight from a userspace-writable submission queue entry, without a speculation barrier, so a CPU can speculatively index past the end of those tables and leave the result in cache state. This is Spectre-v1 class hardening: the practical outcome is a kernel-memory disclosure primitive for a local process, not a direct write or a clean privilege escalation, and building a working leak takes a deliberate side-channel harness rather than a one-shot exploit. It matters on GPU nodes because io_uring is reachable from inside an ordinary container unless seccomp blocks it, and a node that hosts several tenants' pods is exactly where a cross-boundary kernel-memory read is worth something. Rated 7.8 by NVD on the CIA triad, which reads high for what is a hardening fix - weigh it as an information-disclosure risk on shared nodes.

Who can reach it

Any local process that can call io_uring_setup and submit SQEs - which includes a tenant process inside a container whose seccomp profile still permits io_uring. Authentication as a local user is required; no privileges beyond that, and no network reach.

What to do

Update to a stable kernel carrying the array_index_nospec sanitization on sqe->opcode and reboot each node - a drain and reboot per GPU host, since there is no live-patch story for this path in mainline. Where a maintenance window is far off, the effective mitigation is to keep io_uring away from tenants: set kernel.io_uring_disabled=2 (or 1 to restrict it to a privileged group) on kernels that support it, or block io_uring_setup, io_uring_enter and io_uring_register in the container runtime's seccomp profile. Both mitigations apply without a reboot, but check first that no workload on the node depends on io_uring.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-21863 https://git.kernel.org/stable/c/1e988c3fe1264708f4f92109203ac5b1d65de50b https://git.kernel.org/stable/c/506b9b5e8c2d2a411ea8fe361333f5081c56d23a https://git.kernel.org/stable/c/b9826e3b26ec031e9063f64a7c735449c43955e4

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.