Live › vulnerability › CVE-2026-99203
Go to dashboardA race in the Linux kernel's pipe code lets a repeated fasync enable on an O_RDWR FIFO, under memory pressure, drop the reader registration while the writer registration stays. A later pipe notification can then signal a freed file, which an unprivileged local user can trigger.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel without the fix that use pipes or FIFOs with asynchronous I/O (FASYNC via F_SETFL or FIOASYNC) on the same file. The sources do not say which kernel versions are affected or how common this use is.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
pipe: preserve existing fasync readers on writer setup failure
F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback.
fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path.
Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before.
This page as .md · .json · in your agent: get_signal("CVE-2026-99203")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.