---
id: "CVE-2026-99265"
kind: "vulnerability"
aliases: ["CVE-2026-99265"]
title: "Linux kernel io_uring: pipe error path can remove unrelated fixed files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "io_uring", "kubernetes", "linux", "self-hosted"]
not_affected_if: ["io-uring-disabled"]
published_at: "2026-11-03T12:17:33+00:00"
first_seen_at: "2026-11-03T12:20:40+00:00"
updated_at: "2026-11-03T12:22:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99265", "first_seen_at": "2026-11-03T12:20:40+00:00"}]
---

# Linux kernel io_uring: pipe error path can remove unrelated fixed files

In io_uring's io_pipe_fixed() path, the kernel drops its lock while io-wq runs the request, so the error path can close fixed-table slots that were reused by other requests. An attacker who can submit io_uring requests may be able to cause unrelated open files to be removed from another request's table.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel version ranges in the fix source.
- Check whether io_uring is enabled with `sysctl kernel.io_uring_disabled`.

## Timeline

- 2026-11-03T12:20:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99265

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

io_uring/openclose: keep the lock in io_pipe_fixed()

io_pipe_fixed() installs both ends of the pipe in the fixed file table,
drops ->uring_lock, and copies the slot numbers to the application. If
that faults, it takes the lock again and removes whatever is in these
slots.

If the request is run by io-wq the lock really is dropped in between, and
the slots are visible to everybody else. By the time the error path gets
to them, they may have been closed and reused, by IORING_OP_CLOSE and a
direct open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is
removed from the table that has nothing to do with the failed request.

Do the copy with the lock held. Faulting in user memory under
->uring_lock is fine, the registration paths do it all the time.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_