io_uring BufferRing OOB

Vulnerability analysis

When a receive operation is issued through io_uring with the MSG_TRUNC flag and an incoming packet is larger than the provided buffer, the network layer returns the full packet length rather than the number of bytes actually copied. The io_uring buffer management incorrectly uses this inflated return value to advance the provided buffer ring, consuming more buffer space than was actually filled and pushing the ring head pointer past valid bounds. This can corrupt adjacent kernel memory and enable out-of-bounds reads or writes on subsequent operations. The fix separates the value returned to the application (which preserves MSG_TRUNC semantics by reporting the full packet size) from the value used internally for buffer consumption, clamping the latter to the minimum of the return value and the actual buffer length. The bug is reachable by any local process that can submit io_uring receive operations using provided buffers and MSG_TRUNC, requiring no special privileges or capabilities.