The Linux kernel vulnerability CVE-2026-81009 involves the io_uring query interface where the user-supplied size (hdr.size) is passed to copy_struct_to_user() without adequate clamping. While io_handle_query_entry() clamps hdr.size for copy_from_user(), it retains the original user value as usize. copy_struct_to_user() uses usize and may clear trailing bytes beyond the kernel's result size, potentially up to nearly 4 GiB due to hdr.size being a 32-bit unsigned integer. This can occur even on error paths where the result size is zero. The interface is accessible without a ring via IORING_REGISTER_QUERY. The fix rejects sizes larger than PAGE_SIZE to prevent excessive zeroing.

The vulnerability allows a user to request an excessively large size for zeroing memory, which could lead to unintended clearing of memory regions. The description does not specify direct exploitation consequences such as privilege escalation or denial of service, nor does it mention active exploitation in the wild. The impact is primarily related to improper memory handling in the kernel's io_uring query interface.

A fix is available that rejects user-supplied sizes larger than PAGE_SIZE in the io_uring query interface, preventing excessive zeroing of memory. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation.