Executive brief
A synchronization issue was identified in the Linux kernel's io_uring subsystem, which handles high-performance data transfers. Under specific network receiving conditions, the system could fail to properly track memory buffers, leading to a situation where the computer's memory is advanced incorrectly while the kernel is still using it. This could potentially lead to system instability or data corruption during high-speed network operations.
Technical details
A logic error in io_uring/net.c existed where the CQE_F_MASK did not include the IORING_CQE_F_BUF_MORE flag. When a bundle recv operation retried within io_recv_finish(), the merge logic would silently drop this flag if the final retry iteration only partially consumed a buffer. This occurs specifically when using provided buffer rings (IOU_PBUF_RING_INC) in incremental mode. The missing flag prevents userspace from knowing a buffer ID is being reused, causing it to wrongfully advance the ring head past an entry still in use by the kernel. The fix adds IORING_CQE_F_BUF_MORE to the CQE_F_MASK to ensure proper inheritance and stripping across iterations.
Affected products
- Linux Linux Kernel 6.12.94, 6.13.x, 6.14.x, 6.15.x
Timeline
- 2026-06-04: disclosed: Initial patch submission by Clément Léger
- 2026-06-19: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-06-25: advisory: CVE-2026-53191 published