CVE-2026-53191: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
In the Linux kernel, the following vulnerability has been resolved:
iouring/net: inherit IORINGCQEFBUFMORE across bundle recv retries
When a bundle recv retries inside iorecvfinish(), the merge logic OR the saved cflags from the previous iteration with the cflags returned by the new iteration: cflags = req->cqe.flags | (cflags & CQEFMASK);
Bits listed in CQEFMASK are inherited from the new iteration, and all other bits (notably IORINGCQEFBUFFER and the buffer ID) come from the saved cflags. Before this change CQEFMASK covered only IORINGCQEFSOCKNONEMPTY and IORINGCQEFMORE.
When using provided buffer rings (IOUPBUFRINGINC) with incremental mode, and bundle recv, iokbufinccommit() can leave the head ring entry partially consumed, ioputkbufs() then sets IORINGCQEFBUFMORE on the returned cflags so userspace knows the buffer ID will be reused for subsequent completions.
Because IORINGCQEFBUFMORE was not in CQEFMASK, the merge above silently dropped it whenever the final retry iteration partially consumed the buffer, and the subsequent req->cqe.flags = cflags & ~CQEFMASK save would have left a stale IORINGCQEFBUFMORE in the carried-over cflags had one been present. Userspace would then wrongfully advance it ring head past an entry the kernel still uses.
Add IORINGCQEFBUFMORE to CQEFMASK so it is both inherited from the new iteration into the user-visible CQE and stripped from the saved cflags between iterations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel logic in io_uring/net so that IORING_CQE_F_BUF_MORE is included in CQE_F_MASK; this ensures that the merge logic ORs/merges cflags correctly and preserves IORING_CQE_F_BUF_MORE across bundle recv retries, preventing it from being silently dropped or left stale.
Linux kernel io_uring/net CQE_F_MASK = Add IORING_CQE_F_BUF_MORE to CQE_F_MASK (so IORING_CQE_F_BUF_MORE is inherited across bundle recv retries)
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Linux kernel users of io_uring bundle receive with provided buffer rings in incremental mode (IOU_PBUF_RING_INC). Systems not using that combination are not described as affected.
What conditions cause the incorrect completion flags?
A bundle receive must retry within io_recv_finish(), and the final retry must partially consume a provided buffer. Under those conditions, IORING_CQE_F_BUF_MORE can be dropped or retained incorrectly across retry iterations.
How can an application identify that it may be encountering the problem?
Applications using incremental provided buffer rings and bundle receive can inspect completion behavior for inconsistent IORING_CQE_F_BUF_MORE handling, including a missing flag when a buffer ID should be reused or a stale flag carried into a later completion.