CVE-2026-99231
Received Received - Intake

Race Condition in Linux Kernel io_uring Subsystem

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head io_waitid_remove_wq() only takes the wait queue lock if ->head is set. io_waitid_wait() clears ->head first thing, before it tries to become the owner of the request by bumping ->refs. If somebody else owns the request at that point, nothing keeps it from completing the request while the wake up handler is still going to touch it: CPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref) list_del_init(&wait->entry) smp_store_release(&iw->head, NULL) __do_wait() finds another child io_waitid_remove_wq() // ->head == NULL, no locking io_waitid_finish(), IOU_COMPLETE // request freed and reused atomic_fetch_inc(&iw->refs) The same goes for __io_waitid_cancel() if it claims the request in that window. ->refs is part of the per opcode data of the request, so this increments whatever the next user of the request keeps there. If that happens to be zero, the handler concludes that it owns the request, and queues io_waitid_cb() for it. With the window held open by a delay, and the request reused for a receive that is waiting for data: BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0 __wake_up_sync_key+0x36/0x50 sock_def_readable+0xf1/0x420 unix_stream_sendmsg+0x60b/0x1110 Allocated by task 87: io_arm_apoll+0x1ed/0x940 Freed by task 87: __io_submit_flush_completions+0x118d/0x1a10 tctx_task_work_run+0x327/0x950 Only clear ->head once the handler owns the request. If it doesn't, the owner finds ->head set and has to wait for the lock, which is held by the caller of the handler. Deleting the already deleted entry again is harmless.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99231

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 09951a4d37e33b0197afc7fb77e39f09a3213ee6
Linux Linux 934ffdd1cdef232eb125e63c2ebafb7f2deff6af
Linux Linux ab673c1bcaf20ac70352eeb6bf5b828462676693
Linux Linux 6.12.113
Linux Linux 6.18.52
Linux Linux 6.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's io_uring subsystem. It occurs when the io_waitid_wait() function clears a pointer before properly claiming ownership of a request, allowing another CPU to free and reuse the memory while the original handler still tries to access it. This leads to a race condition where freed memory is accessed, causing a slab-use-after-free bug.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and requires kernel-level inspection. Detection involves checking kernel logs for KASAN errors or slab-use-after-free messages related to io_uring operations. Commands like dmesg | grep -i 'KASAN\|slab-use-after-free\|io_uring' may help identify exploitation attempts or crashes.

Impact Analysis

This vulnerability can cause system crashes, data corruption, or privilege escalation. An attacker with local access could exploit this to execute arbitrary code, crash the system, or gain elevated privileges. Systems using io_uring for I/O operations are particularly at risk.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's io_uring subsystem, which could lead to memory corruption, crashes, or privilege escalation. While it does not directly impact compliance with GDPR or HIPAA, such vulnerabilities may violate security requirements in these regulations if they result in unauthorized data access or system compromise.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version where this issue is resolved. Check your distribution's security advisories for kernel updates addressing CVE-2026-99231. If immediate patching is not possible, consider disabling io_uring functionality via kernel boot parameters (e.g., disallowing unprivileged user access to io_uring).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...