Linux kernel io_uring/net (ring-provided buffers pinned across partial retries): Ring-provided buffers are only valid

Impact

Ring-provided buffers are only valid for the execution context that acquired them, but the networking path holds on to one across retries when MSG_WAITALL is set or a stream socket consumed too little. Two consequences follow: if the buffer ring is unregistered before the retry, req->buf_list is stale and the kernel follows a dangling reference; and if several sockets share a buffer group, two receives can land in the same userspace buffer. The second is silent data corruption inside whatever process is using io_uring - on a GPU fleet that is increasingly the inference front end, the object-store client, and the log shipper, where mixing bytes between two connections is both a correctness and a confidentiality failure. Exploitation needs no privilege: any local process that can call io_uring_setup is in range, which includes ordinary tenant pods unless io_uring is blocked.

Who can reach it

Local, unprivileged. Any process able to use io_uring with ring-provided buffers - including a tenant container unless seccomp blocks io_uring_setup - can arrange the partial-retry condition and unregister the buffer ring.

What to do

Patch to a stable kernel that stops partial retries from pinning provided buffers (five backports linked); drain and reboot each node. Where a reboot cannot be scheduled quickly, blocking io_uring_setup/io_uring_register in the container seccomp profile removes tenant access to the path entirely - the common hardened-runtime default already does this - and is the practical interim mitigation.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): A tenant that submits a deliberately malformed array bind to the Xe VM_BIND ioctlCVE-2025-38731 · Linux kernel (drivers/gpu/drm/xe)High
• Linux NFS client: missing minimum-length check when decoding a filehandle lets a crafted handle read out of boundsCVE-2025-39730 · Linux kernel NFS client (nfs_fh_to_dentry filehandle decoding)High
• Linux kernel (drivers/gpu/drm/xe): On the migration error path the previous fence is released before the code waits onCVE-2025-39740 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel perf: throttling a group with disabled members calls PMU start/stop with hw.idx == -1CVE-2025-39821 · Linux kernel perf core (group throttling of inactive events)High
• Linux kernel lpfc: use-after-free in the deferred receive path on Emulex Fibre Channel HBAsCVE-2025-39841 · Linux kernel lpfc driver (Emulex/Broadcom Fibre Channel HBA, deferred receive path)High
• Linux kernel ice: NULL dereference in the E810 low-latency PTP timestamp interrupt during resetCVE-2025-39854 · Linux kernel ice driver (Intel E810 PTP low-latency Tx timestamp interrupt)High