{"id":"CVE-2026-99230","kind":"vulnerability","aliases":["CVE-2026-99230"],"related":[],"title":"Linux kernel: io_uring futex wait can crash the kernel after command reuse","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n  RIP: 0010:io_futexv_complete+0x219/0x420\n  Call Trace:\n   tctx_task_work_run+0x804/0x950\n   tctx_task_work+0x71/0xa0\n   task_work_run+0x118/0x200\n\nLeave the node unhashed.","summary":"A flaw in the Linux kernel's io_uring subsystem leaves a stale list pointer in a recycled request, so a woken vectored futex wait can dereference it. The sources describe a general protection fault (kernel crash) and do not state that an attacker can run code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","io_uring","kernel","linux","ublk"],"not_affected_if":["io-uring-disabled"],"how_to_check":"- Run `uname -r` and compare the kernel version with the fixed versions in the kernel stable branches once published.\n- Check whether io_uring is enabled: `cat /proc/sys/kernel/io_uring_disabled` (unknown whether this is conclusive).\n- Check whether ublk (`ublk_drv`) is loaded with `lsmod | grep ublk`, since the sources cite a ublk FETCH_REQ path.","fix":null,"status":"open","published_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:54+00:00","updated_at":"2026-11-02T16:26:54+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T16:26:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: io_uring futex wait can crash the kernel after command reuse","impact":"medium","summary":"A flaw in the Linux kernel's io_uring subsystem leaves a stale list pointer in a recycled request, so a woken vectored futex wait can dereference it. The sources describe a general protection fault (kernel crash) and do not state that an attacker can run code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","io_uring","ublk"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel crashes; possible memory corruption on affected hosts","analyst_note":"Confirm the fixed kernel versions and whether an unprivileged local user can trigger the futex path; the NVD entry gave no severity or fix details.","how_to_check":"- Run `uname -r` and compare the kernel version with the fixed versions in the kernel stable branches once published.\n- Check whether io_uring is enabled: `cat /proc/sys/kernel/io_uring_disabled` (unknown whether this is conclusive).\n- Check whether ublk (`ublk_drv`) is loaded with `lsmod | grep ublk`, since the sources cite a ublk FETCH_REQ path.","plain_action":"","needs_analyst":true,"not_affected_if":["io-uring-disabled"],"who_is_affected":"The sources describe a path that needs a cancelable io_uring command (for example a ublk FETCH_REQ) followed by a vectored futex wait that is woken during setup. Systems running Linux kernels that include the io_uring code without this change are the ones to look at, especially hosts running ublk or io_uring-heavy workloads. Systems without io_uring or ublk in use are likely not reachable through this path, though the sources do not state that explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000796,"input_tokens":4522,"output_tokens":687,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':259C,267C,272C,277C '-2026':15A,18A '-99230':16A,19A '0010':255C '0xdead000000000120':253C 'access':250C 'add':163C 'address':244C 'attack':69B 'behind':113C 'cach':123C 'call':261C 'cancel':97C,106C,218C 'canon':243C 'cmd':95C,108C,220C 'code':72B 'command':12A,104C 'complet':172C,184C,189C,258C 'crash':8A,62B 'cve':14A,17A 'del':96C,100C,192C 'derefer':52B 'describ':56B 'doesn':161C 'e.g':225C 'end':185C 'everi':129C 'fault':60B,238C 'fetch':228C 'fine':195C 'flaw':27B 'follow':78C 'futex':5A,49B,144C,149C,157C,167C,188C 'futexv':159C,183C,257C 'general':58B,236C 'hash':91C,115C,132C 'hlist':99C,191C 'infrastructur':20B 'init':193C 'io':3A,21B,33B,83C,93C,158C,182C,187C,256C 'kasan':245C 'kernel':2A,10A,23B,31B,61B,76C 'leav':36B,87C,110C,170C,211C,279C 'life':224C 'linux':1A,24B,30B,75C 'list':39B,88C,111C,168C,233C 'mayb':246C 'memori':249C 'multipl':151C 'node':92C,116C,133C,210C,281C 'non':242C 'non-canon':241C 'oop':235C 'pointer':40B 'poison':89C 'poison1/2':112C 'poison2':234C 'previous':223C 'probabl':239C 'protect':59B,237C 'queu':177C 'queue':155C 'rang':252C 'recycl':43B,119C 'reinitialis':126C 'req':229C 'request':44B,117C,122C,165C,198C,215C 'resolv':82C 'reus':13A 'rip':254C 'run':71B,266C,276C 'set':134C 'setup':152C 'sourc':55B 'stale':38B 'state':66B 'still':154C 'subsystem':35B 'take':102C 'task':175C,264C,270C,274C 'tctx':263C,269C 'trace':262C 'ublk':25B,227C 'unhash':201C,282C 'ure':4A,22B,34B,94C,107C,219C 'uring/cmd':84C 'use':98C,140C 'user':130C,207C 'vector':48B,143C 'vulner':79C 'wait':6A,50B,145C,150C,160C 'wake':180C 'whose':190C 'wild':248C 'wild-memory-access':247C 'without':124C 'woken':47B,147C 'work':176C,265C,271C,275C 'write':231C 'x118/0x200':278C 'x219/0x420':260C 'x71/0xa0':273C 'x804/0x950':268C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a path that needs a cancelable io_uring command (for example a ublk FETCH_REQ) followed by a vectored futex wait that is woken during setup. Systems running Linux kernels that include the io_uring code without this change are the ones to look at, especially hosts running ublk or io_uring-heavy workloads. Systems without io_uring or ublk in use are likely not reachable through this path, though the sources do not state that explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","iouring","kernel","linux","ublk","unknown"],"first_public_at":"2026-11-02T16:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99230","severity":null,"published_at":"2026-11-02T16:17:47+00:00","modified_at":"2026-11-02T16:17:47+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}