Look up another CVE · open CVE-2026-53191 in the interactive tracker
CVE-2026-53191
io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem io_uring. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53191 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When a bundle recv retries inside io_recv_finish(), the merge logic OR the saved cflags from the previous iteration with the cflags returned by the new iteration: cflags = req->cqe.flags | (cflags & CQE_F_MASK); Bits listed in CQE_F_MASK are inherited from the new iteration, and all other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the saved cflags. Before this change CQE_F_MASK covered only IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE. When using provided buffer rings (IOU_PBUF_RING_INC) with incremental mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring entry partially consumed, __io_put_kbufs() then sets IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the buffer ID will be reused for subsequent completions. Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above silently dropped it whenever the final retry iteration partially consumed the buffer, and the subsequent req->cqe.flags = cflags & ~CQE_F_MASK save would have left a stale IORING_CQE_F_BUF_MORE in the carried-over cflags had one been present. Userspace would then wrongfully advance it ring head past an entry the kernel still uses. Add IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from the new iteration into the user-visible CQE and stripped from the saved cflags between iterations.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
io_uring/net.c
- What this is
- IO_URINGMAINTAINERS section matched on io_uring/ · io-uring@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_IO_URING|CONFIG_NET' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_IO_URING, CONFIG_NET
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- io_uring
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.12 | 6.12.94 | f40570fda3f3 |
| 6.12 | 6.18.36 | 0bbc9481f970 |
| 6.12 | 7.0.13 | 4973232a67e4 |
| 6.12 | 7.1 | ed46f39c47eb |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through locally submitted io_uring receive operations with buffer selection and bundle recv; a remote peer can influence socket data, but cannot select these io_uring flags or register the buffer ring by itself.
- AC:LAttack complexity, low
- The trigger is deterministic once the attacker controls the io_uring setup, buffer sizes, and socket data pattern; no uncontrolled race or rare kernel state is required.
- PR:LPrivileges required, low
- A basic unprivileged local user can normally create an io_uring instance, register an incremental provided-buffer ring, and submit IORING_OP_RECV, absent non-default sysctl or LSM restrictions.
- UI:NUser interaction, none
- No separate victim interaction is required after the attacker submits the crafted io_uring operations and supplies socket data.
- S:UScope, unchanged
- This is a kernel/io_uring buffer ownership bug and does not cross a VM, IOMMU, or other separate security authority boundary.
- C:HConfidentiality impact, high
- The dropped BUF_MORE flag can make userspace reclaim a buffer that the kernel will continue to use, creating a use-after-recycle style memory corruption primitive in an affected io_uring consumer.
- I:HIntegrity impact, high
- The stale ownership state can cause later kernel receives to write attacker-controlled socket data into memory that the application has legitimately reused, which is a high-impact corruption primitive.
- A:HAvailability impact, high
- The same buffer reuse corruption can crash or destabilize an affected io_uring receiver, and repeated triggering is under attacker control once the vulnerable operation pattern is in use.