CVE-2026-81009

kernel: Linux kernel: Denial of Service in io_uring/query due to excessive memory zeroing

Published Sep 11, 2026 CVSS 3.1 · 4.7 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2b8ad4981ecedb14c1fdd811ab977010b23933e6
https://git.kernel.org/stable/c/417e02f7b6051765b91cf1289071882eebd172e0
https://git.kernel.org/stable/c/ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b
https://nvd.nist.gov/vuln/detail/CVE-2026-81009
https://www.cve.org/CVERecord?id=CVE-2026-81009

History

Type	Values Removed	Values Added
Description	In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title	io_uring/query: cap user size passed to copy_struct_to_user	kernel: Linux kernel: Denial of Service in io_uring/query due to excessive memory zeroing
CPEs	cpe:2.3:o:linux:linux_kernel::::::::

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-81009 https://www.cve.org/CVERecord?id=CVE-2026-81009
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces.
Title		io_uring/query: cap user size passed to copy_struct_to_user
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2b8ad4981ecedb14c1fdd811ab977010b23933e6 https://git.kernel.org/stable/c/417e02f7b6051765b91cf1289071882eebd172e0 https://git.kernel.org/stable/c/ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b