The vulnerability arises from an integer overflow that occurs when userspace passes a sqe->len value that exceeds INT_MAX. The overflow turns a 32‑bit unsigned length into a negative signed value, which is later interpreted as an astronomically large size when the kernel processes receive/send messages via io_uring. Because the size is not clamped, the kernel repeatedly reads past the end of the iovec array in io_bundle_nbufs(). This out‑of‑bounds read pulls data from the kmalloc‑64 slab, causing the kernel to expose potentially sensitive data and potentially crash. The weakness is an integer overflow leading to memory corruption (CWE‑190, CWE‑681).

All Linux kernel releases that do not include the commit that implements the check for negative sr->len values, i.e. kernels before the patch applied in the commit chain referenced in the advisory. Distribution kernels that are out‑of‑date relative to the latest kernel releases are affected.

Because the flaw is triggered by a user‑controlled io_uring submission, an attacker with local kernel access or the ability to run a program that submits crafted io_uring requests could exploit the bug. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not explicitly provided but the nature of the bug suggests a high potential for information disclosure if successfully leveraged.