PT-2026-39103 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43442

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring component where the boundary check for 128-byte Submission Queue Entry (SQE) operations in the io init req() function validates the logical SQ head position instead of the physical SQE index when IORING SETUP SQE MIXED is used without IORING SETUP NO SQARRAY. An unprivileged user can remap a logical position to an arbitrary physical index via sq array. By setting sq array[N] to sq entries - 1, a 128-byte operation is placed at the last physical SQE slot, leading the io uring cmd sqe copy() function to read 64 bytes beyond the end of the SQE array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43442

Affected Products

Linux Kernel

References · 11

• https://cve.org/CVERecord?id=CVE-2026-43442 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43442 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43442 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43442 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43442 · Vendor Advisory
• https://git.kernel.org/stable/c/6f02c6b196036dbb6defb4647d8707d29b7fe95b · Patch
• https://git.kernel.org/stable/c/1f794f9bed3e5cf7250a3b4daf112a72ed1513e9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43442 · Security Note
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://twitter.com/CVEnew/status/2052767626531934363 · Twitter Post
• https://git.kernel.org/linus/6f02c6b196036dbb6defb4647d8707d29b7fe95b · Note