CVE-2025-39822
published 2025-09-16CVE-2025-39822: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: fix signedness in this_len calculation
When importing and using buffers, buf->len is considered unsigned.
However, buf->len is converted to signed int when committing. This can
lead to unexpected behavior if the buffer is large enough to be
interpreted as a negative value. Make min_t calculation unsigned.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.5-1 (forky) | linux 6.16.5-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= cf9536e550dd243a1681fdbf804221527da20a80 < f4f411c068402c370c4f9a9d4950a97af97bbbb1 | f4f411c068402c370c4f9a9d4950a97af97bbbb1 |
| linux | linux | >= cf9536e550dd243a1681fdbf804221527da20a80 < c64eff368ac676e8540344d27a3de47e0ad90d21 | c64eff368ac676e8540344d27a3de47e0ad90d21 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.16.5-1 | 6.16.5-1 |
| linux | linux_kernel | >= 6.12 < 6.16.5 | 6.16.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5xmf-424g-jjhg: In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: fix signedness in this_len calculation
When importing and using b
ghsa_unreviewed·2025-09-16
CVE-2025-39822 [MEDIUM] GHSA-5xmf-424g-jjhg: In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: fix signedness in this_len calculation
When importing and using b
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: fix signedness in this_len calculation
When importing and using buffers, buf->len is considered unsigned.
However, buf->len is converted to signed int when committing. This can
lead to unexpected behavior if the buffer is large enough to be
interpreted as a negative value. Make min_t calculation unsigned.
OSV
CVE-2025-39822: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buf
osv·2025-09-16·CVSS 5.5
CVE-2025-39822 [MEDIUM] CVE-2025-39822: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buf
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough to be interpreted as a negative value. Make min_t calculation unsigned.
Red Hat
kernel: io_uring/kbuf: fix signedness in this_len calculation
vendor_redhat·2025-09-16·CVSS 5.5
CVE-2025-39822 [MEDIUM] CWE-681 kernel: io_uring/kbuf: fix signedness in this_len calculation
kernel: io_uring/kbuf: fix signedness in this_len calculation
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: fix signedness in this_len calculation
When importing and using buffers, buf->len is considered unsigned.
However, buf->len is converted to signed int when committing. This can
lead to unexpected behavior if the buffer is large enough to be
interpreted as a negative value. Make min_t calculation unsigned.
Statement: This vulnerability is rated Moderate for Red Hat Enterprise Linux 10 as it could lead to a local privilege escalation due to a signedness error in the io_uring subsystem. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected as the vulnerable code is not present in these versions. If triggered, this vulnerability can lead to integ
Debian
CVE-2025-39822: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb...
vendor_debian·2025·CVSS 5.5
CVE-2025-39822 [MEDIUM] CVE-2025-39822: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/kb...
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough to be interpreted as a negative value. Make min_t calculation unsigned.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.5-1)
sid: resolved (fixed in 6.16.5-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
2025-09-16
Published