CVE-2026-97618

Received Received - Intake

Buffer Overconsumption in Linux Kernel io_uring with MSG_TRUNC

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overconsume buffers when using MSG_TRUNC When a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than the number of bytes actually copied into the buffer. As a result, io_uring advances more of the provided buffer ring than was actually filled. Use the actual filled region size to consume the buffer, but still return the full size to preserve MSG_TRUNC semantics. Take care with multishot, because that seems to already truncate the consumption based on the available payload size. This was reported in https://github.com/axboe/liburing/issues/1619. [axboe: fold in size_t unsigned fix]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97618

EUVD

EUVD-2026-86749

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect buffer handling when using the MSG_TRUNC flag with recv or recvmsg system calls in io_uring. When a packet larger than the buffer is received, the net layer returns the full packet length instead of the bytes copied. This causes io_uring to consume more buffer space than actually filled, potentially leading to buffer overconsumption and data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying if your kernel version includes the fix. Use commands like 'uname -r' to check your kernel version and compare it against patched versions. Monitor system logs for io_uring-related errors during network operations.

Impact Analysis

This vulnerability could lead to buffer overconsumption in io_uring, causing memory corruption, crashes, or unexpected behavior in applications using MSG_TRUNC with large packets. It may also expose systems to denial-of-service conditions if exploited maliciously.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to buffer handling in io_uring operations. Compliance risks would only arise if this flaw led to data leaks or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling io_uring features temporarily or restricting network operations that use MSG_TRUNC with recv/recvmsg calls until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-97618. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70