CVE-2026-97618

A flaw was found in the Linux kernel's io_uring subsystem. This vulnerability allows a local user to cause a denial of service (DoS) or buffer corruption. When handling network receive operations configured with the packet truncation flag (MSG_TRUNC), the kernel calculates buffer consumption based on the total packet length instead of the bytes actually copied into the buffer. This mismatch causes io_uring to advance the buffer ring past the filled region, resulting in overconsumption of buffers and potential system instability.

An io_uring receive operation using MSG_TRUNC can incorrectly consume the full reported packet length from a provided buffer ring even when only part of the packet was copied. This can advance the ring beyond the buffers that were actually filled, prematurely consume available entries, and cause ENOBUFS, dropped messages, or disruption of the receiving application. A remote peer may trigger the condition by sending packets larger than the selected buffers when a network service uses io_uring provided buffer rings, incremental buffer consumption, and MSG_TRUNC. For the CVSS the PR:N value is used because an attacker only needs network access to an already configured vulnerable service and does not need a local account on the target. The required io_uring configuration and application behavior make the attack conditional and support AC:H. Impact is primarily limited denial of service. The paranoid score includes limited integrity impact because incorrect buffer accounting may cause message loss or application level data misassociation, but there is no demonstrated UAF, OOB access, arbitrary write, kernel crash, or privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.