The Linux kernel’s io_uring implementation mistakenly uses a logical queue head value to perform a boundary check for 128‑byte SQE operations instead of validating the physical SQE index. When IORING_SETUP_SQE_MIXED is used without the IORING_SETUP_NO_SQARRAY flag, an attacker can remap a logical position to an arbitrary physical index via the sq_array interface. Setting sq_array[N] to the last physical slot forces the kernel to copy 128 bytes from that location, which reads 64 bytes past the end of the SQE array, potentially revealing adjacent kernel memory contents.

Any Linux kernel that still uses the pre-fix io_uring logic is affected. The vulnerability applies to all kernel releases before the commit that corrects the boundary check, regardless of distribution or package version, as long as the SQE_MIXED mode is available in the running kernel.

The EPSS score is less than 1 %, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog and no CVSS score is provided in the data. Exploitation requires local access to create an io_uring instance with SQE_MIXED and the ability to manipulate sq_array; it does not provide privilege escalation or arbitrary code execution, but it does enable kernel‑memory disclosure that could be leveraged by other attacks.