CVE-2026-53191

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries

When a bundle recv retries inside io_recv_finish(), the merge logic OR

the saved cflags from the previous iteration with the cflags returned by

the new iteration:

cflags = req->cqe.flags | (cflags & CQE_F_MASK);

Bits listed in CQE_F_MASK are inherited from the new iteration, and all

other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the

saved cflags. Before this change CQE_F_MASK covered only

IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE.

When using provided buffer rings (IOU_PBUF_RING_INC) with incremental

mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring

entry partially consumed, __io_put_kbufs() then sets

IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the

buffer ID will be reused for subsequent completions.

Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above

silently

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References