CVE-2026-99265

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

CVE-2026-99265 io_uring/openclose: keep the lock in io_pipe_fixed()

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

EUVD-2026-115790

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

CVE-2026-99265

The Linux kernel contains a vulnerability in io_uring/openclose related to the io_pipe_fixed() function. The issue occurs because the ->uring_lock is dropped before copying slot numbers to the application; if the copy faults, the error path re-acquires the lock and removes content from slots t...

PT-2026-136101

In the Linux kernel, the following vulnerability has been resolved: io uring/openclose: keep the lock in io pipe fixed io pipe fixed installs both ends of the pipe in the fixed file table, drops -uring lock, and copies the slot numbers to the application. If that faults, it takes the lock again a...

Linux kernel io_uring Heap Buffer Overflow DoS

The vulnerability of the ioopenatprep function in the iouring/openclose.c module, which is part of the Linux kernel’s asynchronous input/output interface, relates to the failure to release resources after their useful period has ended. Exploiting this vulnerability could allow an attacker to caus...