{"id":"CVE-2026-99203","kind":"vulnerability","aliases":["CVE-2026-99203"],"related":[],"title":"Linux kernel: failed fasync enable on FIFO leaves freed-file signal use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke ->fasync() before\npipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips ->fasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper's result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before.","summary":"A race in the Linux kernel's pipe code lets a repeated fasync enable on an O_RDWR FIFO, under memory pressure, drop the reader registration while the writer registration stays. A later pipe notification can then signal a freed file, which an unprivileged local user can trigger.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":["unpatched-kernel-not-present"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-99203 (the sources do not name the fixed version)","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:58+00:00","updated_at":"2026-10-28T11:33:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:33:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-99203 (the sources do not name the fixed version)","reach":"local","title":"Linux kernel: failed fasync enable on FIFO leaves freed-file signal use-after-free","impact":"high","summary":"A race in the Linux kernel's pipe code lets a repeated fasync enable on an O_RDWR FIFO, under memory pressure, drop the reader registration while the writer registration stays. A later pipe notification can then signal a freed file, which an unprivileged local user can trigger.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"local user triggers kernel use-after-free via signal delivery","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-99203) or the kernel stable tree.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unpatched-kernel-not-present"],"who_is_affected":"Systems running a Linux kernel without the fix that use pipes or FIFOs with asynchronous I/O (FASYNC via F_SETFL or FIOASYNC) on the same file. The sources do not say which kernel versions are affected or how common this use is.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3617,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-99203':19A,22A 'add':228C 'alloc':127C,153C 'call':227C 'callback':124C 'chang':234C 'check':129C 'clear':168C 'code':38B 'continu':260C 'cve':17A,20A 'decid':101C 'derefer':186C 'drop':52B 'duplic':250C,258C 'enabl':5A,43B,113C,137C,143C,259C 'enter':122C 'entri':133C,140C,148C,157C,167C,173C 'error':159C 'exist':90C,132C,165C,253C 'f':97C,192C 'fa':263C 'fail':3A,151C,240C,249C 'failur':96C 'fasync':4A,42B,91C,105C,108C,125C,169C,179C,256C 'fd':264C 'fifo':7A,48B,118C 'file':11A,70B,189C 'fioasync':100C 'first':136C 'follow':83C 'fput':176C 'free':16A,207C 'freed':10A,69B,188C 'freed-fil':9A 'helper':126C,217C 'host':29B 'instal':138C 'invok':104C 'kasan':202C 'keep':214C 'kernel':2A,25B,35B,81C 'later':62B,182C 'leav':8A 'let':39B 'linux':1A,24B,34B,80C 'linux-kernel':23B 'list':237C 'local':74B 'memori':50B,197C 'memory-pressur':196C 'mutex':111C,232C 'new':241C 'notif':64B,184C 'o':46B,116C 'one':115C 'owner':193C 'path':160C,213C 'pipe':37B,63B,88C,107C,110C,183C,231C 'pre':164C 'pre-exist':163C 'preserv':89C,251C 'pressur':51B,198C 'race':31B 'rdwr':47B,117C 'reader':54B,92C,147C,166C,216C,246C 'regist':175C 'registr':55B,59B,223C,242C,254C 'remain':174C 'remov':161C,244C 'repeat':41B 'reproduc':199C 'resolv':87C 'result':219C 'runtim':26B 'second':142C 'self':28B 'self-host':27B 'send':209C 'serial':233C 'setfl':98C 'setup':95C 'sigio':210C 'signal':12A,67B 'skip':178C 'slab':204C 'slab-use-after-fre':203C 'stay':60B 'still':243C 'success':257C 'take':109C 'therefor':120C 'trigger':77B,200C 'two':112C 'undo':221C 'unprivileg':73B,195C 'updat':145C,262C 'use':14A,205C 'use-after-fre':13A 'user':75B 'vulner':84C 'whether':102C 'writer':58B,94C,156C,172C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without the fix that use pipes or FIFOs with asynchronous I/O (FASYNC via F_SETFL or FIOASYNC) on the same file. The sources do not say which kernel versions are affected or how common this use is.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99203","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}