This Linux kernel flaw in the io_uring subsystem enables an out‑of‑bounds read during the __io_uring_show_fdinfo routine, which appears when the kernel tries to display file descriptor information for a mixed‑size SQE ring. The wrong wrap‑around check uses an incremented counter instead of the actual array index, allowing the routine to read past the end of the sq_sqes array and potentially expose kernel memory content to an attacker with local user rights. The exposed data may contain sensitive information such as credentials or configuration details, but the vulnerability does not permit arbitrary code execution.

The issue is present in all Linux kernels that contain the vulnerable io_uring implementation before the commit that introduced the fix. Distributions shipping kernel releases that have not yet applied this patch are affected. No specific version numbers were provided, so all kernel builds prior to the commit are considered potentially vulnerable.

The flaw requires a local process that can invoke the __io_uring_show_fdinfo routine, implying that only privileged or local users can exploit it. The CVSS score of 7.1 indicates a significant threat, while the EPSS score of less than 1% indicates that malicious exploitation is currently unlikely. Because the vulnerability is not listed in CISA KEV, there are no confirmed exploit cases yet. Nonetheless, the data leakage could be valuable for a local adversary seeking to pivot to higher privileges or gain additional system context.