CVE-2026-99229 io_uring/wait: don't spin on a stuck overflow list

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

CVE-2026-99229

The Linux kernel contains a vulnerability in io_uring where a task can become stuck spinning in the kernel and become unkillable. This occurs when the IO_CHECK_CQ_OVERFLOW_BIT is set and io_cqring_wait_schedule() fails to flush a stuck overflow list. The issue is triggered if the CQ ring cannot h...

CVE-2026-99230 io_uring/cmd: don't leave list poison in ->hash_node

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99230

The Linux kernel contains a vulnerability where the io_uring_cmd_del_cancelable() function uses hlist_del() to remove a command from ->cancelable_uring_cmd, leaving LIST_POISON1/2 behind in the ->hash_node. Because requests are recycled through a request cache without being reinitialised, s...

CVE-2026-99229 io_uring/wait: don't spin on a stuck overflow list

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

EUVD-2026-115272

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

EUVD-2026-115271

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

EUVD-2026-115270

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99228

The Linux kernel contains a vulnerability in io_uring/io-wq where threads can hang indefinitely during exit if they submitted an IORING_OP_OPENAT request for a FIFO without a writer using IOSQE_ASYNC. The root cause is that workers for bounded work (like fifo_open) might lose the signal intended ...

CVE-2026-99228 io_uring/io-wq: don't lose the signal that ends work

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99228 io_uring/io-wq: don't lose the signal that ends work

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99227

The Linux kernel contains a vulnerability in the io_uring/waitid component where the reference counter (bits 30:0 of ->refs) can wrap to zero due to repeated failed cancellation attempts. Specifically, __io_waitid_cancel() increments the reference field even if the cancellation returns false. ...

EUVD-2026-115269

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99226 keys: Avoid the owner account dereference in named keyring lookup

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99226 keys: Avoid the owner account dereference in named keyring lookup

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99226

The Linux kernel contains a vulnerability in the named keyring lookup function find_keyring_by_name(). The root cause is a use-after-free (confirmed by KASAN reports) where the function reads keyring->user->uid while holding keyring_name_lock. Because this lock only protects the keyring's n...

EUVD-2026-115268

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

EUVD-2026-115267

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...