CVE-2026-99266
Received Received - Intake

io_uring Buffer Offset Miscalculation in Linux Kernel

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offset of the buffer in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 that goes into the CQE. An area can be up to 1TB in size. For every niov beyond the first 4GB the CQE points the application at a buffer 4GB, or a multiple of that, below the one which has the data. It reads the wrong data, and then returns a buffer it doesn't own via the refill queue while the real one is never given back.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99266
EUVD
EUVD-2026-115791

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 11ed914bbf948c4a37248f2876973ac18014056d
Linux Linux 11ed914bbf948c4a37248f2876973ac18014056d
Linux Linux 6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects io_uring's zcrx functionality. It involves incorrect buffer offset calculations when areas exceed 4GB. The function io_zcrx_queue_cqe() uses a 32-bit unsigned integer for shifting, causing the offset to wrap around every 4GB. This results in the CQE pointing to the wrong buffer, leading to data corruption or use of unowned memory.

Detection Guidance

This vulnerability affects the Linux kernel's io_uring/zcrx subsystem and is related to incorrect buffer offset calculations in areas above 4GB. Detection requires checking the kernel version and io_uring configuration. Use 'uname -r' to check the kernel version and examine io_uring parameters with 'cat /proc/sys/fs/io_uring'.

Impact Analysis

If exploited, this flaw could allow an attacker to read or write incorrect data by manipulating buffer offsets. It may cause applications to access memory they shouldn't, leading to crashes, data leaks, or privilege escalation. Systems using io_uring with large buffers are most at risk.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves the io_uring/zcrx buffer offset issue. Check your distribution's security advisories for kernel updates and apply them promptly. If updating is not immediately possible, consider disabling io_uring features if they are not critical to system operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...