CVE-2026-99265

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

CVE-2026-99265 io_uring/openclose: keep the lock in io_pipe_fixed()

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

EUVD-2026-115790

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

CVE-2026-99265

The Linux kernel contains a vulnerability in io_uring/openclose related to the io_pipe_fixed() function. The issue occurs because the ->uring_lock is dropped before copying slot numbers to the application; if the copy faults, the error path re-acquires the lock and removes content from slots t...