CVE-2023-54030: io_uring/net: don't overflow multishot recv

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-24 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overflow multishot recv Don't allow overflowing multishot recv CQEs, it might get out of hand, hurt performance, and in the worst case scenario OOM the task.

Affected products

Linux kernel: 6.0 — fixed in 6.6

How to fix

Upgrade to a fixed version: Linux kernel 6.6. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/1e2db9837be7d24a2a74eb3f3906d0872bee8907
https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560

Get alerted when CVE-2023-54030 or the next vulnerability affects your stack