CVE-2026-31774

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path: 1. io_recv(): sel.val = sr->len (ssize_t gets -1) 2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF) 3. io_ring_buffers_peek(): buf->len is not clamped because max_len is astronomically large 4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs() 5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array This results in a slab-out-of-bounds read in io_bundle_nbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries. BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: io_bundle_nbufs+0x128/0x160 io_recv_finish+0x117/0xe20 io_recv+0x2db/0x1160 Fix this by rejecting negative sr->len values early in both io_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32, any value > INT_MAX indicates overflow and is not a valid length.

• CWE-125

• https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7cPatch
• https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6Patch
• https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5Patch
• https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328becPatch

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31769In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-3177The Charitable – Donation Plugin for WordPress – Fundraising…5.3
• CVE-2026-31770In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31771In the Linux kernel, the following vulnerability has been re…8.1
• CVE-2026-31772In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31773In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-31775In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31776In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31777In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31778In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-31779In the Linux kernel, the following vulnerability has been re…8.1
• CVE-2026-3178The Name Directory plugin for WordPress is vulnerable to Sto…7.2