{"id":"CVE-2026-99266","kind":"vulnerability","aliases":["CVE-2026-99266"],"related":[],"title":"Linux kernel: io_uring zero-copy receive returns wrong buffers above 4GB","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix buffer offsets in areas above 4GB\n\nio_zcrx_queue_cqe() computes the offset of the buffer in its area from\nnet_iov_idx(), which is an unsigned int, so the shift is done in 32 bits\nand only the result is widened to the u64 that goes into the CQE. An area\ncan be up to 1TB in size. For every niov beyond the first 4GB the CQE\npoints the application at a buffer 4GB, or a multiple of that, below the\none which has the data. It reads the wrong data, and then returns a\nbuffer it doesn't own via the refill queue while the real one is never\ngiven back.","summary":"In the Linux kernel's io_uring zero-copy receive path, buffer offsets are computed in 32 bits, so for areas above 4GB the completion entries point the application at the wrong memory. An application can read the wrong data and return buffers it does not own while the real buffers are never given back.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["io-uring","linux-kernel","runtime","zcrx"],"not_affected_if":["no-io-uring-zcrx"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","triaged_at":"2026-11-03T12:22:39+00:00","updated_at":"2026-11-03T12:22:39+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T12:22:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: io_uring zero-copy receive returns wrong buffers above 4GB","impact":"medium","summary":"In the Linux kernel's io_uring zero-copy receive path, buffer offsets are computed in 32 bits, so for areas above 4GB the completion entries point the application at the wrong memory. An application can read the wrong data and return buffers it does not own while the real buffers are never given back.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","io-uring","zcrx"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"wrong data read and buffers mishandled, with possible data exposure","analyst_note":"Find the affected kernel version ranges and the fixed commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99266 and check whether zcrx is enabled by default.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-io-uring-zcrx"],"who_is_affected":"Systems running a Linux kernel with io_uring zero-copy receive (zcrx) and receive areas larger than 4GB are the exposed case, since the offset error only occurs for buffers beyond the first 4GB. The sources do not say which kernel versions are affected or whether the feature is on by default. Teams not using io_uring zcrx can likely skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4258,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99266':16A,19A '1tb':153C '32':45B,131C '4gb':13A,51B,102C,162C,171C 'applic':57B,63B,167C 'area':49B,100C,115C,148C 'back':83B,209C 'beyond':159C 'bit':46B,132C 'buffer':11A,40B,71B,79B,97C,112C,170C,193C 'complet':53B 'comput':43B,107C 'copi':7A,37B 'cqe':106C,146C,164C 'cve':14A,17A 'data':68B,183C,188C 'doesn':195C 'done':129C 'entri':54B 'everi':157C 'first':161C 'fix':96C 'follow':89C 'given':82B,208C 'goe':143C 'idx':119C 'int':124C 'io':3A,21B,33B,94C,103C 'io-ur':20B 'iov':118C 'kernel':2A,25B,31B,87C 'linux':1A,24B,30B,86C 'linux-kernel':23B 'memori':61B 'multipl':174C 'net':117C 'never':81B,207C 'niov':158C 'offset':41B,98C,109C 'one':179C,205C 'path':39B 'point':55B,165C 'queue':105C,201C 'read':65B,185C 'real':78B,204C 'receiv':8A,38B 'refil':200C 'resolv':93C 'result':136C 'return':9A,70B,191C 'runtim':26B 'shift':127C 'size':155C 'u64':141C 'unsign':123C 'ure':4A,22B,34B 'uring/zcrx':95C 'via':198C 'vulner':90C 'widen':138C 'wrong':10A,60B,67B,187C 'zcrx':27B,104C 'zero':6A,36B 'zero-copi':5A,35B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring zero-copy receive (zcrx) and receive areas larger than 4GB are the exposed case, since the offset error only occurs for buffers beyond the first 4GB. The sources do not say which kernel versions are affected or whether the feature is on by default. Teams not using io_uring zcrx can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["iouring","linuxkernel","runtime","unknown","zcrx"],"first_public_at":"2026-11-03T12:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99266","severity":null,"published_at":"2026-11-03T12:17:33+00:00","modified_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:40+00:00","fetched_at":"2026-11-03T12:20:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}