CVE-2026-53191

A flaw was found in the Linux kernel's io_uring networking component. During bundle receive retries, an issue with inheriting the IORING_CQE_F_BUF_MORE flag can cause the userspace to incorrectly advance the ring head. This memory handling error could lead to information disclosure or potentially allow an attacker to escalate privileges.

This vulnerability is evaluated as having a Moderate severity because exploitation requires local unprivileged access to configure specific io_uring network operations, limiting the attack surface compared to remote threats. The issue stems from improper handling of completion flags during retry sequences when using bundle receive modes with incremental buffer rings, which can corrupt buffer ring tracking between user space and the kernel. Consequently, an unprivileged local attacker could cause kernel memory inconsistencies leading to denial of service or potential privilege escalation. Earlier Red Hat Enterprise Linux releases do not include support for these incremental buffer features and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.