Linux io_uring: bundle recv drops IORING_CQE_F_BUF_MORE, so userspace advances past a buffer the kernel still uses

Impact

With provided buffer rings in incremental mode and bundle recv, a retry inside io_recv_finish() merged completion flags in a way that silently dropped IORING_CQE_F_BUF_MORE, and could carry a stale copy of the bit into the next iteration. The signal that tells userspace a buffer ID will be reused is therefore lost, so the application advances its ring head past an entry the kernel is still writing into - the kernel and the application end up disagreeing about who owns a buffer. The exposure is to whoever is driving the io_uring instance: an inference or storage server using incremental provided buffers gets memory handed back under it, which reads as data corruption or a crash in that service rather than a cross-tenant escape. Only configurations using IOU_PBUF_RING_INC with bundle recv are affected.

Who can reach it

Local - the process using io_uring with incremental provided buffer rings and bundle recv. Triggered by the local workload's own I/O pattern; no separate authentication boundary is crossed.

What to do

Update to a stable kernel that adds IORING_CQE_F_BUF_MORE to CQE_F_MASK. Workloads can avoid the path by not combining incremental provided buffer rings with bundle recv until the kernel is updated. Taking the kernel fix means drain and reboot each node.

References

Related entries

• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGESCVE-2026-53362 · Linux kernel IPv6 (__ip6_append_data paged allocation path)High
• Linux FUSE: request not re-locked before page cache folio replacement, giving a use-after-freeCVE-2026-53388 · Linux kernel FUSE (fuse_try_move_folio page cache replacement)High
• libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary filesCVE-2026-63622 · libvirt (virFileChownFiles over the swtpm state directory)High
• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux bpf: sysctl write buffer allocated with kvzalloc but freed with kfree, corrupting memoryCVE-2026-63809 · Linux kernel BPF cgroup sysctl hook (__cgroup_bpf_run_filter_sysctl buffer free)High