{"id":"CVE-2026-99179","kind":"vulnerability","aliases":["CVE-2026-99179"],"related":[],"title":"Linux kernel: watch queue race lets unprivileged user crash the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix note pool publication race in watch_queue_set_size()\n\nThere is a race between watch_queue_set_size() and post_one_notification().\nwatch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and\nnr_notes with plain stores, and post_one_notification() reads them with\nplain loads under a different lock, so nothing orders the four stores\nagainst the poster's loads: depending on the build, notes can be stored\nlast (gcc 14 on x86-64 does this).  Since keyctl_watch_key() lets a watch\nattach to a queue before it is sized, post_one_notification() can already\nbe running on another CPU at that moment: it reads nr_notes > 0, passes\nits bounds check, and then reads notes while it is still NULL,\ndereferencing notes[0].\n\nAn unprivileged user triggers this reliably by watching one of its own\nkeys through a notification pipe and racing ioctl(IOC_WATCH_QUEUE_SET_SIZE)\non that pipe against keyctl(KEYCTL_SETPERM) on the key from another CPU,\ntriggering:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:post_one_notification.isra.0+0xa2/0x1e0\n  Call Trace:\n   __post_watch_notification+0x148/0x180\n   keyctl_setperm_key+0x119/0x130\n   do_syscall_64+0x108/0x4c0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nFix this by publishing nr_notes last with smp_store_release(), and by\nreading it once with smp_load_acquire() in post_one_notification() before\nthe bitmap and the page array are touched.  A poster that observes a\nnon-zero nr_notes then also observes the pool behind it; one that observes\nzero drops the notification as before.","summary":"A race between setting a watch queue's size and posting a notification leaves the note pool pointer NULL while the kernel dereferences it. An unprivileged local user can trigger a kernel NULL pointer dereference and panic the machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","multi-user-hosts","runtime","self-hosted"],"not_affected_if":["no-untrusted-local-users","patched-kernel"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the upstream stable advisories (unknown from these sources)\n- Check whether the kernel includes the commit that publishes `nr_notes` with `smp_store_release()` in `watch_queue_set_size()` (unknown from these sources)","fix":"- Update the Linux kernel to a stable release that includes the watch_queue note pool publication fix (exact versions unknown from these sources)\n- Until patched, restrict local unprivileged use of keyctl watch and notification pipes where feasible (unknown from these sources)","status":"open","published_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:25+00:00","updated_at":"2026-10-28T11:35:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the watch_queue note pool publication fix (exact versions unknown from these sources)\n- Until patched, restrict local unprivileged use of keyctl watch and notification pipes where feasible (unknown from these sources)","reach":"local","title":"Linux kernel: watch queue race lets unprivileged user crash the system","impact":"medium","summary":"A race between setting a watch queue's size and posting a notification leaves the note pool pointer NULL while the kernel dereferences it. An unprivileged local user can trigger a kernel NULL pointer dereference and panic the machine.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","multi-user-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user panics the kernel, causing machine crash and denial of service","analyst_note":"Find the fixed stable kernel versions and the upstream commit for this watch_queue fix; the sources give no version ranges or CVSS score.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the upstream stable advisories (unknown from these sources)\n- Check whether the kernel includes the commit that publishes `nr_notes` with `smp_store_release()` in `watch_queue_set_size()` (unknown from these sources)","needs_analyst":true,"not_affected_if":["patched-kernel","no-untrusted-local-users"],"who_is_affected":"Systems running a Linux kernel without this fix that allow unprivileged local users to run code, including multi-user hosts, shared CI runners and container hosts where untrusted code runs. The sources describe a local trigger using keyctl watches and notification pipes, so machines with no local untrusted users are lower risk. unknown for exact affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":3892,"output_tokens":665,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':259C,266C,271C,276C,283C '-2026':13A,16A '-64':157C '-99179':14A,17A '0':192C,208C,258C '0000000000000000':254C '0010':256C '14':154C '64':275C,280C 'acquir':312C 'address':253C 'alreadi':179C 'also':337C 'anoth':183C,245C 'array':323C 'attach':167C 'behind':341C 'bitmap':111C,319C 'bound':195C 'bug':248C 'build':147C 'call':261C 'check':196C 'cpu':184C,246C 'crash':9A 'cve':12A,15A 'depend':144C 'derefer':51B,63B,252C 'dereferenc':206C 'differ':131C 'drop':347C 'entri':278C 'except':290C 'fatal':289C 'fix':80C,293C 'follow':73C 'four':137C 'gcc':153C 'host':24B,28B 'hwframe':282C 'interrupt':292C 'ioc':229C 'ioctl':228C 'kernel':2A,20B,50B,60B,71C,249C,285C 'key':163C,221C,243C,270C 'keyctl':161C,238C,239C,268C 'last':152C,299C 'leav':42B 'let':6A,164C 'linux':1A,19B,70C 'linux-kernel':18B 'load':128C,143C,311C 'local':55B 'lock':132C 'machin':67B 'moment':187C 'multi':22B 'multi-user-host':21B 'non':332C 'non-zero':331C 'note':44B,81C,109C,110C,116C,148C,191C,200C,207C,298C,335C 'noth':134C 'notif':41B,102C,123C,177C,224C,265C,316C,349C 'nr':112C,115C,190C,297C,334C 'null':47B,61B,205C,250C 'observ':329C,338C,345C 'one':101C,122C,176C,217C,315C,343C 'order':135C 'page':113C,322C 'panic':65B,286C 'pass':193C 'pipe':225C,236C 'plain':118C,127C 'pointer':46B,62B,251C 'pool':45B,82C,340C 'post':39B,100C,121C,175C,263C,314C 'post_one_notification.isra':257C 'poster':141C,327C 'public':83C 'publish':107C,296C 'queue':4A,35B,79C,87C,96C,104C,170C,231C 'race':5A,30B,84C,93C,227C 'read':124C,189C,199C,306C 'releas':303C 'reliabl':214C 'resolv':77C 'rip':255C 'run':181C 'runtim':25B 'self':27B 'self-host':26B 'set':32B,88C,97C,105C,232C 'setperm':240C,269C 'sinc':160C 'size':37B,89C,98C,106C,174C,233C 'smp':301C,310C 'still':204C 'store':119C,138C,151C,302C 'sync':288C 'syscal':274C,279C 'system':11A 'touch':325C 'trace':262C 'trigger':58B,212C,247C 'unprivileg':7A,54B,210C 'user':8A,23B,56B,211C 'vulner':74C 'watch':3A,34B,78C,86C,95C,103C,162C,166C,216C,230C,264C 'wqueue':108C 'x108/0x4c0':277C 'x119/0x130':272C 'x148/0x180':267C 'x77/0x7f':284C 'x86':156C 'xa2/0x1e0':260C 'zero':333C,346C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without this fix that allow unprivileged local users to run code, including multi-user hosts, shared CI runners and container hosts where untrusted code runs. The sources describe a local trigger using keyctl watches and notification pipes, so machines with no local untrusted users are lower risk. unknown for exact affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99179","severity":null,"published_at":"2026-10-28T11:17:38+00:00","modified_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}