CVE-2026-53191

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring/net component where the IORING CQE F BUF MORE flag is not correctly inherited across bundle recv retries within the io recv finish() function. When using provided buffer rings in incremental mode (IOU PBUF RING INC) with bundle recv, the io kbuf inc commit() function may leave the head ring entry partially consumed. In such cases, io put kbufs() sets the IORING CQE F BUF MORE flag on the returned cflags to notify userspace that the buffer ID will be reused. However, because IORING CQE F BUF MORE was missing from the CQE F MASK, the merge logic silently dropped this flag during the final retry iteration. This can lead to userspace incorrectly advancing the ring head past an entry that the kernel is still utilizing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.