Linux kernel io_uring: registered-buffer folio offset miscalculated for unaligned user pointers

Impact

io_uring registered buffers computed the offset of the first page into a coalesced folio with bit-mask logic that assumed the user virtual address was aligned. With an unaligned pointer the wrong offset is used, so I/O can land on the wrong bytes of the mapping - the NVD scoring treats this as local confidentiality, integrity and availability impact. On a GPU node this matters because io_uring is reachable from inside any unprivileged container unless seccomp blocks it, so a tenant process on a shared node is the attacker population. The record is a stable-tree fix with no exploit detail, so treat the ceiling as memory corruption in kernel context rather than a demonstrated escape.

Who can reach it

Local, unprivileged: any process that can call io_uring_setup and register buffers, including a tenant inside a GPU pod when io_uring is not blocked by seccomp. No authentication beyond having code execution on the node.

What to do

Take the stable kernel update that carries the io_uring/rsrc fix (commits linked in the record) and reboot each node; there is no runtime toggle for the bug itself. As a stopgap on multi-tenant GPU nodes, disable io_uring for untrusted workloads - kernel.io_uring_disabled sysctl, or a seccomp profile that denies io_uring_setup - which avoids the reboot until a maintenance window. No fixed release version is stated in the record beyond the listed commits.

References

Related entries

• Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if theCVE-2025-40274 · Linux kernel (virt/kvm)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• VMware Aria Operations / VMware Tools: Local privilege escalation to root inside a managed VM via SDMP service discoveryCVE-2025-41244 · VMware Aria Operations / VMware ToolsHigh
• PAM (pam-config): Local user is treated as `allow_active` in PAMCVE-2025-6018 · PAM (pam-config)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd): A division by zero in the amdkfd (KFD compute driverCVE-2025-68174 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amd/amdkfd)High
• Linux kernel NVMe: use-after-free on the admin request_queue during controller teardownCVE-2025-68265 · Linux kernel NVMe driver (admin request_queue lifetime)High