CVE-2026-99230 io_uring/cmd: don't leave list poison in ->hash_node

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99230

The Linux kernel contains a vulnerability where the io_uring_cmd_del_cancelable() function uses hlist_del() to remove a command from ->cancelable_uring_cmd, leaving LIST_POISON1/2 behind in the ->hash_node. Because requests are recycled through a request cache without being reinitialised, s...

CVE-2026-99230: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in…

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...