Linux kernel io_uring zero-copy receive: desc->count underflow lets a recv overshoot its limit

Impact

io_zcrx_recv_skb() adjusts desc->count for every received buffer including frag lists, then recurses to process the frag list skbs, so the count is accounted twice and underflows. A zero-copy receive request can then deliver more data than was requested, writing past the length the application reserved. Exposure depends on io_uring zero-copy receive actually being in use: it is a recent, opt-in path that a tenant process must set up itself, so a node whose workloads do not use zcrx is not reachable here. Where it is used - high-throughput ingest or storage front ends on GPU nodes - a local process driving its own zcrx socket can corrupt its own receive accounting, and the record gives availability impact as high.

Who can reach it

A local process that can create io_uring zero-copy receive requests, combined with the remote peer's segmentation producing frag lists. No authentication beyond having the ability to run code on the node and use io_uring; unreachable if io_uring zcrx is disabled or unused.

What to do

Take the stable kernel update carrying commits 09cfd3c52ea7 / 8bcc9eaf1b19. That means drain and reboot each affected node - expensive on a GPU host mid-training, so schedule it with your next kernel window unless you actively run io_uring zero-copy receive workloads. Interim mitigation is to keep io_uring restricted (for example via the io_uring_disabled sysctl or seccomp) for untrusted tenants, which also covers the rest of this subsystem's history.

References

Related entries

• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High
• sudo: intercept policy checks skipped for execveat, letting allowed users run denied commandsCVE-2026-82474 · sudo (ptrace-based intercept mode, execveat/fexecve path)High
• Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel virtio-net: malicious host-announced buffer length causes NULL page dereference in guestCVE-2025-40292 · Linux kernel virtio-net (big-packet receive length check)High
• Linux kernel sockmap: bpf_msg_push_data mis-advances split fragment offset, corrupting scatterlist layoutCVE-2026-63926 · Linux kernel bpf sockmap (bpf_msg_push_data fragment offset)High
• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High