CVE-2025-39816
published 2025-09-16CVE-2025-39816: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.
Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.5-1 (forky) | linux 6.16.5-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= ae98dbf43d755b4e111fcd086e53939bef3e9a1a < 695673eb5711ee5eb1769481cf1503714716a7d1 | 695673eb5711ee5eb1769481cf1503714716a7d1 |
| linux | linux | >= ae98dbf43d755b4e111fcd086e53939bef3e9a1a < 91f262ea2a76a02d9e37dba6637cfe6feebb20a8 | 91f262ea2a76a02d9e37dba6637cfe6feebb20a8 |
| linux | linux | >= ae98dbf43d755b4e111fcd086e53939bef3e9a1a < 390a61d284e1ced088d43928dfcf6f86fffdd780 | 390a61d284e1ced088d43928dfcf6f86fffdd780 |
| linux | linux | >= ae98dbf43d755b4e111fcd086e53939bef3e9a1a < 98b6fa62c84f2e129161e976a5b9b3cb4ccd117b | 98b6fa62c84f2e129161e976a5b9b3cb4ccd117b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.12.57-1 | 6.12.57-1 |
| linux | linux_kernel | >= 0 < 6.16.5-1 | 6.16.5-1 |
| linux | linux_kernel | >= 6.12 < 6.12.49 | 6.12.49 |
| linux | linux_kernel | >= 6.13 < 6.16.5 | 6.16.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
vendor_redhat·2025-09-16·CVSS 5.5
CVE-2025-39816 [MEDIUM] CWE-367 kernel: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
kernel: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.
Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.
Statement: This vulnerability is rated Moderate for Red Hat E
Debian
CVE-2025-39816: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb...
vendor_debian·2025·CVSS 5.5
CVE-2025-39816 [MEDIUM] CVE-2025-39816: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb...
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.5-1)
sid: resolved (fixed in 6.16.5-1)
trixie: resolved (fixed i
OSV
CVE-2025-39816: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since t
osv·2025-09-16·CVSS 5.5
CVE-2025-39816 [MEDIUM] CVE-2025-39816: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since t
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point.
GHSA
GHSA-57pg-f379-59c5: In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since
ghsa_unreviewed·2025-09-16
CVE-2025-39816 [MEDIUM] GHSA-57pg-f379-59c5: In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.
Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.
No detection rules found.
No public exploits indexed.
2025-09-16
Published