A bug in the Linux kernel's io_uring/net subsystem causes the system to overconsume input buffers when a receive operation is issued with the MSG_TRUNC flag and the supplied packet is larger than the buffer. Instead of returning the number of bytes actually stored, the network layer reports the full packet length, leading the io_uring layer to advance more buffer slots than were used. This misalignment can allow the kernel to believe buffers are free when they still contain unconsumed data, potentially leading to data loss, corruption, or resource exhaustion. The flaw directly affects data integrity and may allow an adversary to induce a denial‑of‑service condition.

The vulnerability applies to the Linux kernel, all vendor implementations of the Linux operating system. No specific version is listed in the advisory; it exists in releases that have not yet incorporated the patch addressing the over‑consumption bug. System administrators should consider that any kernel version prior to the fix contains the issue.

The CVSS score is not disclosed, and EPSS information is unavailable, so the precise estimate of risk remains unclear. The bug is not listed in the CISA KEV catalog and there are currently no known public exploits. Attack vectors would likely require local access to a system running a vulnerable kernel and the use of io_uring recv operations with the MSG_TRUNC flag. Because the flaw does not provide a straightforward privilege escalation path, the risk level is moderate but the impact on availability could be significant if exploited.