CVE-2026-99230
Received Received - Intake

Use-After-Free in Linux Kernel io_uring

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_node. Requests are recycled through the request cache without being reinitialised, and not every user of ->hash_node sets it up before it is used: If a vectored futex wait is woken while futex_wait_multiple_setup() is still queueing the futexes, io_futexv_wait() doesn't add the request to ->futex_list, and leaves the completion to the task_work queued by the wake up. io_futexv_complete() ends in __io_futex_complete(), whose hlist_del_init() is fine for a request that is unhashed, which is how all other users of the node leave it. If the request was a cancelable uring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through LIST_POISON2: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-...] RIP: 0010:io_futexv_complete+0x219/0x420 Call Trace: tctx_task_work_run+0x804/0x950 tctx_task_work+0x71/0xa0 task_work_run+0x118/0x200 Leave the node unhashed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99230

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 93b8cc60c37b9d17732b7a297e5dca29b50a990d
Linux Linux 93b8cc60c37b9d17732b7a297e5dca29b50a990d
Linux Linux 93b8cc60c37b9d17732b7a297e5dca29b50a990d
Linux Linux 6.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves io_uring/cmd operations where a command is removed from a list without properly clearing its hash_node. This leaves poison values (LIST_POISON1/2) in the node, which can cause memory corruption when the request is reused. A race condition during futex wait operations can trigger a use-after-free scenario, leading to a kernel oops or crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and may not have direct detection commands. However, monitoring for kernel oops or general protection faults, especially after io_uring operations, could indicate exploitation. Check kernel logs for errors like 'general protection fault' or 'KASAN: wild-memory-access'.

Impact Analysis

This vulnerability can cause system instability, including kernel crashes or oops, leading to denial-of-service conditions. Attackers could exploit it to execute arbitrary code in the kernel context, potentially gaining full control over the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory corruption in the Linux io_uring subsystem. Compliance impacts would only occur if the vulnerability leads to data breaches or system instability, which is not specified in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using io_uring features temporarily if an update is not immediately available. Monitor kernel logs for suspicious activity related to io_uring operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99230. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...