CVE-2026-53191

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries<br /> <br /> When a bundle recv retries inside io_recv_finish(), the merge logic OR<br /> the saved cflags from the previous iteration with the cflags returned by<br /> the new iteration:<br /> cflags = req-&gt;cqe.flags | (cflags &amp; CQE_F_MASK);<br /> <br /> Bits listed in CQE_F_MASK are inherited from the new iteration, and all<br /> other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the<br /> saved cflags. Before this change CQE_F_MASK covered only<br /> IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE.<br /> <br /> When using provided buffer rings (IOU_PBUF_RING_INC) with incremental<br /> mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring<br /> entry partially consumed, __io_put_kbufs() then sets<br /> IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the<br /> buffer ID will be reused for subsequent completions.<br /> <br /> Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above<br /> silently dropped it whenever the final retry iteration partially<br /> consumed the buffer, and the subsequent req-&gt;cqe.flags = cflags &amp;<br /> ~CQE_F_MASK save would have left a stale IORING_CQE_F_BUF_MORE in the<br /> carried-over cflags had one been present. Userspace would then<br /> wrongfully advance it ring head past an entry the kernel still uses.<br /> <br /> Add IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from the<br /> new iteration into the user-visible CQE and stripped from the saved<br /> cflags between iterations.