The Linux kernel vulnerability CVE-2025-40046 concerns the io_uring subsystem's zcrx request handling. The function io_zcrx_recv_skb() adjusts the descriptor count for all received buffers, including fragment lists, but recursive processing of fragment list skbs leads to double counting and underflow of the descriptor count. This causes the system to receive more data than requested, potentially leading to information disclosure or system instability. The vulnerability has been resolved in the Linux kernel, though explicit patch details or affected versions are not provided in the input data.

The vulnerability allows a zcrx request to receive more data than intended, which can lead to partial information disclosure (confidentiality impact), potential modification of data (integrity impact), and disruption of service (availability impact). The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact but high availability impact.

The vulnerability has been resolved in the Linux kernel. However, no explicit patch or remediation details are provided in the input data. Users should monitor official Linux kernel advisories for the relevant patch and apply it promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.