CVE-2026-99232 tracing/syscalls: Use copy_from_user for the faultable syscall buffer

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99232

The Linux kernel contains a vulnerability in the tracing/syscalls component where the function syscall_copy_user_array() uses __copy_from_user() to copy buffer arguments for faultable syscalls (such as write and pwrite64 ). Because __copy_from_user() skips the access_ok() check, it fails to prope...

EUVD-2026-115274

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99232 tracing/syscalls: Use copy_from_user for the faultable syscall buffer

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99231 io_uring/waitid: own the request before clearing ->head

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99231

The Linux kernel contains a vulnerability in the io_uring subsystem related to waitid. The root cause is that io_waitid_wait() clears the ->head pointer before attempting to own the request by incrementing ->refs. This creates a race condition where another process might complete the reques...

EUVD-2026-115273

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99231 io_uring/waitid: own the request before clearing ->head

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99230 io_uring/cmd: don't leave list poison in ->hash_node

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99229

The Linux kernel contains a vulnerability in io_uring where a task can become stuck spinning in the kernel and become unkillable. This occurs when the IO_CHECK_CQ_OVERFLOW_BIT is set and io_cqring_wait_schedule() fails to flush a stuck overflow list. The issue is triggered if the CQ ring cannot h...

CVE-2026-99230 io_uring/cmd: don't leave list poison in ->hash_node

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99230

The Linux kernel contains a vulnerability where the io_uring_cmd_del_cancelable() function uses hlist_del() to remove a command from ->cancelable_uring_cmd, leaving LIST_POISON1/2 behind in the ->hash_node. Because requests are recycled through a request cache without being reinitialised, s...

CVE-2026-99229 io_uring/wait: don't spin on a stuck overflow list

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

CVE-2026-99229 io_uring/wait: don't spin on a stuck overflow list

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

EUVD-2026-115272

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

EUVD-2026-115271

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

EUVD-2026-115270

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99228

The Linux kernel contains a vulnerability in io_uring/io-wq where threads can hang indefinitely during exit if they submitted an IORING_OP_OPENAT request for a FIFO without a writer using IOSQE_ASYNC. The root cause is that workers for bounded work (like fifo_open) might lose the signal intended ...

CVE-2026-99228 io_uring/io-wq: don't lose the signal that ends work

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99228 io_uring/io-wq: don't lose the signal that ends work

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...