The kernel incorrectly handles receive retries when buffers are partially filled. It commits only the bytes actually received, but does not mark the rest of the buffer as committed. When a subsequent request using the same buffer group is issued, the kernel hands out the uncommitted portion for a new transfer, causing the new request to write over memory that the original retry is still targeting. This results in overlapping writes and can corrupt application data or the buffer contents, effectively breaking data integrity. The weakness is a form of improper buffer management and synchronization within the io_uring net subsystem.

It can be inferred that all Linux kernel versions prior to the commit that fixed the issue are affected. The exact affected releases are not specified in the data, but any system that uses io_uring receive operations and may retry partial transfers before the commit could be vulnerable.

EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. No documented exploit has been reported. The likely attack vector is local to the host, requiring an attacker to have control of an application that uses io_uring receive operations. Due to the absence of a CVSS score, the exact severity rating cannot be quantified, but the weakness could lead to data corruption and compromise system reliability.