In the Linux kernel, a flaw in the io_uring subsystem’s bundle receive logic causes the IORING_CQE_F_BUF_MORE flag to be incorrectly dropped and stale flags to persist. This can lead userspace to advance the buffer ring head while the kernel still holds the buffer, potentially overwriting in‑use memory and resulting in kernel instability or crashes. The bug affects the flag handling for bundle receive retries when buffer rings are used in incremental mode.

Vulnerable kernels are those that ran before the patch was applied, including kernel 7.1 RC releases from rc1 through rc6 and earlier 7.x series. All Linux distributions shipping such kernels that expose io_uring with buffer ring support are susceptible until an update is installed.

The CVSS score of 7.8 signals high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating low current exploitation likelihood. A local application that performs bundle receive operations with buffer rings would need to trigger multiple retries and partial consumption to exploit the flaw. No public exploits are known, but the potential for a kernel panic or denial of service remains.