Linux Kernel io_uring Overshooting recv Limit Vulnerability

A vulnerability in the Linux kernel's io_uring implementation can cause a zcrx request to receive more data than requested. This issue arises because the function io_zcrx_recv_skb() improperly counts received buffers, including those in fragment lists, leading to double accounting and an underflow in the count. The vulnerability affects the stable version of the Linux kernel.

Impact

The vulnerability can lead to incorrect data handling in io_uring zcrx requests, potentially causing applications to misinterpret received data or disrupt normal data processing workflows.

Remediation

Users can upgrade to the latest stable version of the Linux kernel to address this vulnerability. The patched version is included in the Linux kernel stable tree.