CVE-2025-40046
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
28/10/2025
Last modified:
30/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
io_uring/zcrx: fix overshooting recv limit<br />
<br />
It&#39;s reported that sometimes a zcrx request can receive more than was<br />
requested. It&#39;s caused by io_zcrx_recv_skb() adjusting desc->count for<br />
all received buffers including frag lists, but then doing recursive<br />
calls to process frag list skbs, which leads to desc->count double<br />
accounting and underflow.