The Linux kernel’s io_uring query interface mishandles the hdr.size field that is passed to copy_struct_to_user. The value is clamped for copy_from_user but then reused by copy_struct_to_user(); hdr.size is a __u32, a caller can request an amount of zeroing nearly up to 4 GiB, even on error paths where no data is returned. This can overwrite user‑space memory beyond the intended buffer, leading to memory corruption and potentially a denial‑of‑service when the kernel attempts to access invalid memory.

All Linux kernel installations that have not applied the CVE‑2026‑81009 patch are affected. The vulnerability is present in any distribution that ships the unpatched kernel, as the io_uring query interface can be reached via the IORING_REGISTER_QUERY ioctl even when no ring is allocated.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is <1%, which indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The likely attack vector requires a local user running on the same system as the vulnerable kernel, able to invoke the IORING_REGISTER code execution or persistence, but it enables local buffer overwrite that can lead to denial of service if an attacker controls a process that can supply a crafted hdr.size value.