Linux Kernel io_uring Buffer Reallocation Vulnerability

A vulnerability in the Linux kernel's io_uring buffer management has been addressed. The issue arose because the IORING_REGISTER_PBUF_RING operation could reuse an old io_buffer_list structure that was originally created for legacy selected buffers and had been emptied. This behavior violated the requirement that most fields should remain stable after publication. The vulnerability has been resolved by ensuring that the buffer lists are always reallocated upon upgrade.

Impact

Exploitation of this vulnerability could lead to unintended behavior in buffer management, potentially causing data corruption or instability in applications using io_uring.