AIKIDO-2026-863571

TL;DR

The userspace syscall verifiers for sendmsg and recvmsg snapshot the caller message header into a kernel copy but then re-read the iovec count and other fields from the original userspace pointer for allocation and iteration. A second thread in the same memory domain can inflate the iovec count between the allocation and the copy loop, so the loop writes iovec entries past the kernel heap allocation. The overflow corrupts adjacent heap chunk metadata and yields local kernel heap corruption or a crash from unprivileged userspace. The fix uses the kernel copy of the header for all post-verification field accesses.