CVE-2026-97618

Executive Summary

CVE-2026-97618 is a buffer management flaw in the Linux kernel's io_uring networking subsystem, specifically affecting recv/recvmsg operations issued with the MSG_TRUNC flag. When an incoming packet is larger than the supplied buffer, the network layer reports the full packet length rather than the number of bytes actually copied, causing io_uring to advance the provided buffer ring by more bytes than were written. Systems running vulnerable kernel versions with applications that use io_uring multishot or provided-buffer networking are affected. The impact is potential out-of-bounds buffer consumption leading to data corruption, information disclosure, or denial of service.

Technical Analysis

The io_uring subsystem allows applications to submit asynchronous I/O operations, including network receive operations, to the kernel. A key performance feature is provided buffer rings: the application pre-registers a pool of buffers that the kernel consumes as data arrives, avoiding per-operation memory management overhead.

The vulnerability arises in the interaction between MSG_TRUNC semantics and the buffer-consumption accounting logic. MSG_TRUNC is a socket flag that instructs the kernel to return the real length of the datagram or packet even when it is larger than the buffer provided by the caller. This is useful for protocols where the application wants to detect truncation. However, the value returned under MSG_TRUNC reflects the full packet length, not the number of bytes that were actually written into the buffer.

In io_uring, when a recv/recvmsg completes, the kernel must advance or consume a corresponding portion of the provided buffer ring so that subsequent operations use fresh buffer space. Because MSG_TRUNC causes the reported length to exceed the actual filled region, the buffer-consumption logic advances more of the ring than was genuinely written. This means regions of the provided buffer ring that were never populated get marked as consumed, and worse, the accounting can drift such that the kernel writes subsequent data into offsets that exceed the intended buffer boundaries.

The bug report specifically notes that multishot operations already appear to truncate consumption based on the available payload size, so care was required to avoid breaking that path while fixing the single-shot path. The upstream fix was to use the actual filled region size — not the MSG_TRUNC-reported full size — to determine how much of the buffer to consume, while still returning the full size to userspace to preserve MSG_TRUNC semantics. A secondary unsigned-size correction (a size_t fix) was folded into the change, indicating a type-width issue in the arithmetic.

From a security standpoint, incorrect buffer-ring accounting in a kernel memory management path is significant. The kernel may write data at an offset beyond the intended region, or mark consumed regions inconsistently, resulting in out-of-bounds writes into the buffer ring. Depending on the layout of the provided buffers (which may be user-managed memory mapped into the ring), this can lead to memory corruption of process-owned memory or, in configurations where buffers are kernel-allocated, corruption of adjacent kernel data structures. The precise primitive depends on the application's use of io_uring and the buffer registration model, which is not fully specified in the available description.

Attack surface: the flaw is reachable by any process that uses io_uring networking with MSG_TRUNC on a socket where an attacker or network peer can send packets larger than the supplied buffer. Multishot receive paths require additional scrutiny because the description notes they have differing consumption behavior.

No CWE was assigned by the CNA. Based on the described mechanism (exceeding intended buffer bounds via miscalculated consumption), CWE-787 (Out-of-bounds Write) or CWE-193 (Off-by-one Error) are the closest classes, but this classification is an inference and not an authoritative assignment.

Exploitation Scenarios

No public proof-of-concept is available, and no exploit code or Nuclei template exists for this CVE. The following attack chain is inferred from the vulnerability class and the available technical description.

1. Reconnaissance / target identification: An attacker identifies a host running a vulnerable Linux kernel where an application (local or remote-facing) uses io_uring network receive operations with provided buffers and the MSG_TRUNC flag. Concrete version ranges are not specified in the available data, so identification requires kernel version fingerprinting against the upstream fix, once released.

2. Triggering the flaw: The attacker causes a packet larger than the receive buffer to be delivered to the io_uring-based socket. Because MSG_TRUNC makes the kernel report the full packet length, the buffer-ring consumption logic advances more of the provided buffer ring than was actually filled. This is the core trigger — oversized packet plus MSG_TRUNC plus provided buffers.

3. Payload / execution method: The attacker controls the size and, in a network-facing scenario, the contents of subsequent packets. Repeated oversized packets cause the consumption accounting to drift, and subsequent receives may write data beyond the intended buffer region. Class-level description: an attacker crafts a sequence of oversized datagrams to induce out-of-bounds writes into the provided buffer ring. Specific offsets, structure layouts, and exploitation primitives cannot be derived from the available description and are not stated here.

4. Post-exploitation impact: Depending on adjacency and buffer placement, the out-of-bounds write can corrupt process memory or adjacent kernel structures, potentially yielding information disclosure (reading data outside the intended buffer) or denial of service (kernel crash / panic). Escalation to code execution would depend on the specific buffer layout and is not established by the available evidence.

It is important to note that the local/remote applicability depends on which io_uring-based application on the target uses provided buffers with MSG_TRUNC; the CVE data does not identify a specific affected product, so the exposure is a function of deployments, not of a named vendor product.

Impact Assessment

Business impact centers on availability and integrity of systems running vulnerable kernels with io_uring networking workloads. Because io_uring is used by high-performance network services, databases, and proxies, a flaw in buffer-ring accounting can affect production services that otherwise behave normally — the corruption only manifests when oversized packets and MSG_TRUNC are in play.

Blast radius is bounded by the requirement that the target application actively use io_uring provided-buffer networking with MSG_TRUNC. Multishot paths presumably require a different trigger due to their differing consumption behavior, as noted in the description. The flaw affects the kernel, so any mitigation that does not patch the kernel must constrain the application layer, which is impractical for most deployments.

CVSS: NVD has not assigned a score or vector for this CVE. No CVSS subscores can be referenced. The EPSS score has not been published by FIRST.org, and no EPSS value should be assumed. CISA KEV status is NO — there is no evidence of known exploitation in the wild at the time of writing. There is no public PoC, no Nuclei template, no exploit code, and no OSV package mapping.

Detection Guidance

Sigma Rule

title: Potential io_uring MSG_TRUNC Buffer Overconsumption Activity
id: 8f3c1a2e-5b7d-4c9a-9e21-7a6d4f0b1c33
status: experimental
description: Detects kernel log or audit indicators associated with io_uring recv/recvmsg MSG_TRUNC buffer overconsumption (CVE-2026-97618)
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - 'io_uring'
    - 'MSG_TRUNC'
    - 'provided buffer'
    - 'buffer ring'
    - 'net: don''t overconsume buffers'
  condition: keywords
falsepositives:
  - Legitimate kernel messages referencing io_uring buffer usage
  - Development and debugging workloads using io_uring
level: medium
tags:
  - attack.t1190
  - cve.2026.97618

YARA Rule

rule CVE_2026_97618_io_uring_msg_trunc
{
    meta:
        description = "Detects kernel crash/log strings referencing io_uring MSG_TRUNC buffer overconsumption (CVE-2026-97618)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97618"
        severity = "medium"

    strings:
        $s1 = "io_uring/net: don't overconsume buffers when using MSG_TRUNC" ascii wide
        $s2 = "MSG_TRUNC" ascii wide
        $s3 = "provided buffer ring" ascii wide
        $s4 = "multishot" ascii wide
        $s5 = "actual filled region size" ascii wide

    condition:
        uint32(0) == 0x464C457F and 2 of ($s*)
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-97618 Potential io_uring MSG_TRUNC Buffer Overconsumption - Oversized Datagram"; flow:to_server; dsize:>1400; threshold: type both, track by_src, count 20, seconds 10; classtype:attempted-dos; reference:cve,2026-97618; sid:2026976; rev:1;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and
process.name in ("dmesg", "journalctl") and
process.args : "*io_uring*" and process.args : "*MSG_TRUNC*"

Splunk SPL Query

index=linux sourcetype=syslog ("io_uring" AND ("MSG_TRUNC" OR "provided buffer" OR "buffer ring"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="linux,kernel,io_uring,">
  <rule id="100976" level="8">
    <decoded_as>syslog</decoded_as>
    <match>io_uring|MSG_TRUNC|provided buffer ring</match>
    <description>CVE-2026-97618: Possible io_uring MSG_TRUNC buffer overconsumption — check kernel version</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97618,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source, no vendor fix, no affected version list published in the tracked data).

1. Immediate mitigations:

• Because the flaw requires io_uring provided-buffer networking with MSG_TRUNC, constrain or disable MSG_TRUNC usage in io_uring-based applications where configurable.
• Consider disabling io_uring for untrusted workloads via the io_uring_disabled sysctl (kernel 6.6+) where the host does not require it. This removes the attack surface entirely for affected binaries.
• Monitor kernel logs for io_uring buffer-related warnings or oopses; treat them as potential exploitation indicators.
• Block or rate-limit oversized datagrams at network boundaries for services that rely on io_uring receive paths, since oversized packets are the trigger.

2. Patch/upgrade steps:

• No released vendor fix is currently available. Track the upstream kernel fix commit referenced in the original report (axboe, folding a size_t unsigned fix) and upgrade to the first stable release that includes it.
• Once a fixed kernel version is published, prioritize upgrading hosts with public-facing or high-throughput network services that use io_uring.

3. Long-term hardening:

• Maintain an inventory of applications using io_uring (check for the io_uring_setup syscall) so kernel changes can be correlated with affected workloads.
• Enable kernel address space and memory corruption monitoring (KASAN in test environments, hardened allocators).
• Adopt a kernel live-patching or rapid-update pipeline to reduce the window between upstream fix and deployment.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97618
• Original report: https://github.com/axboe/liburing/issues/1619
• Linux kernel io_uring networking subsystem documentation
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-97618 not listed at time of writing — CISA KEV: NO)
• FIRST.org EPSS: https://www.first.org/epss (no score published for this CVE)

No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-97618 at the time of writing. No public PoC, no exploit code, and no Nuclei template have been identified.