139 matches found
CVE-2026-99231 io_uring/waitid: own the request before clearing ->head
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
EUVD-2026-115273
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
CVE-2026-99231
The Linux kernel contains a vulnerability in the io_uring subsystem related to waitid. The root cause is that io_waitid_wait() clears the ->head pointer before attempting to own the request by incrementing ->refs. This creates a race condition where another process might complete the reques...
CVE-2026-99231 io_uring/waitid: own the request before clearing ->head
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...
CVE-2026-99227
The Linux kernel contains a vulnerability in the io_uring/waitid component where the reference counter (bits 30:0 of ->refs) can wrap to zero due to repeated failed cancellation attempts. Specifically, __io_waitid_cancel() increments the reference field even if the cancellation returns false. ...
CVE-2026-99227 io_uring/waitid: prevent cancel reference wrap
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...
EUVD-2026-115269
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...
PT-2026-135516
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the io uring/waitid component. The io waitid function uses a 31-bit reference counter within the -refs field, with bit 31 serving as a cancellation...
Linux Distros Unpatched Vulnerability : CVE-2026-99231
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing,...
PT-2026-135520
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.115 Linux kernel versions prior to 6.18.60 Description A use-after-free issue exists in the io uring waitid handling. The io waitid wait function clears the -head variable before establishing ownership of th...
CVE-2026-99231: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing…
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
CVE-2026-99227: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap…
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...
Linux Distros Unpatched Vulnerability : CVE-2026-99227
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: defin...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.7. It arises because iouring/waitid packs the cancellation state into bit 31 of refs and uses bits 0–30 as a reference count. Repeated failed cancellation attempts may cause the 31-bit reference field to wrap around to zero, allowing...
Astra Linux – vulnerability in linux-6.12
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: clear waitid info before copying it to userspace IORINGOPWAITID stores its result fields in struct iowaitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it...
SUSE CVE-2026-81010
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Linux Distros Unpatched Vulnerability : CVE-2026-81010
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating...
CVE-2026-81010
A flaw was found in the Linux kernel's iouring/waitid component. The iowaitidcb function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the dowait function to execute within an incorrect task context, which is critical as waitid...
