CVE-2026-31774 is a high-severity vulnerability in the Linux kernel's io_uring/net subsystem involving a slab-out-of-bounds read in the io_bundle_nbufs() function. The issue arises because a 32-bit unsigned length value from userspace (sqe->len) is stored into a signed int (sr->len), causing integer overflow and a negative length value. This negative value propagates through the code, leading to an infinite loop that reads beyond the allocated memory buffer, triggering a slab-out-of-bounds read detected by KASAN.