CVE-2026-99230

The Linux kernel contains a vulnerability where the io_uring_cmd_del_cancelable() function uses hlist_del() to remove a command from ->cancelable_uring_cmd, leaving LIST_POISON1/2 behind in the ->hash_node. Because requests are recycled through a request cache without being reinitialised, s...