Live › vulnerability › CVE-2026-99265
In io_uring's io_pipe_fixed() path, the kernel drops its lock while io-wq runs the request, so the error path can close fixed-table slots that were reused by other requests. An attacker who can submit io_uring requests may be able to cause unrelated open files to be removed from another request's table.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
Systems running a Linux kernel with io_uring support where io_uring operations use fixed file tables and io-wq. Hosts that disable io_uring or run distributions that restrict it are less exposed. The sources do not list affected kernel version ranges.
No product ranges from the sources yet.
uname -r and compare against the kernel version ranges in the fix source.sysctl kernel.io_uring_disabled.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
io_uring/openclose: keep the lock in io_pipe_fixed()
io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots.
If the request is run by io-wq the lock really is dropped in between, and the slots are visible to everybody else. By the time the error path gets to them, they may have been closed and reused, by IORING_OP_CLOSE and a direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is removed from the table that has nothing to do with the failed request.
Do the copy with the lock held. Faulting in user memory under ->uring_lock is fine, the registration paths do it all the time.
This page as .md · .json · in your agent: get_signal("CVE-2026-99265")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.