CVE-2026-99229

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99229", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.402Z", "datePublished": "2026-11-02T16:06:37.423Z", "dateUpdated": "2026-11-06T17:15:10.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T17:15:10.679Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n is stuck on the list if a single one is free, and then the ring holds\n less than cq_entries events. A single threaded application that asks\n for as many events as the ring has entries never gets out of\n io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n can write to. While one thread waits for events on an empty ring,\n another one can move the head back so that the ring looks full and\n have a CQE overflow. The waiter can't be stopped any more, not even by\n SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/wait.c"], "versions": [{"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "bf1d2ed84b3162e3b0e0bb7018ac59147da6e975", "status": "affected", "versionType": "git"}, {"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "a6cfc85c6bf9498aaf1978b503f9663635a1aa22", "status": "affected", "versionType": "git"}, {"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "4a89352edd8b3e20d1e1fb33f0fc297dd137149f", "status": "affected", "versionType": "git"}, {"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "c347691e5dc5481b2d6943c123619e04847fb0dc", "status": "affected", "versionType": "git"}, {"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "340944e27b4bb218ed0ee66d0947ac70faefa05a", "status": "affected", "versionType": "git"}, {"version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "lessThan": "34f5a664c34d3cb62f6bec7f4156754594a7d25b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/wait.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975"}, {"url": "https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22"}, {"url": "https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f"}, {"url": "https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc"}, {"url": "https://git.kernel.org/stable/c/340944e27b4bb218ed0ee66d0947ac70faefa05a"}, {"url": "https://git.kernel.org/stable/c/34f5a664c34d3cb62f6bec7f4156754594a7d25b"}], "title": "io_uring/wait: don't spin on a stuck overflow list", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/wait.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bf1d2ed84b3162e3b0e0bb7018ac59147da6e975", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}, {"lessThan": "a6cfc85c6bf9498aaf1978b503f9663635a1aa22", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}, {"lessThan": "4a89352edd8b3e20d1e1fb33f0fc297dd137149f", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}, {"lessThan": "c347691e5dc5481b2d6943c123619e04847fb0dc", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}, {"lessThan": "340944e27b4bb218ed0ee66d0947ac70faefa05a", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}, {"lessThan": "34f5a664c34d3cb62f6bec7f4156754594a7d25b", "status": "affected", "version": "3fcf19d592d5cb63eb209400b22055651e3c27d0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/wait.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n is stuck on the list if a single one is free, and then the ring holds\n less than cq_entries events. A single threaded application that asks\n for as many events as the ring has entries never gets out of\n io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n can write to. While one thread waits for events on an empty ring,\n another one can move the head back so that the ring looks full and\n have a CQE overflow. The waiter can't be stopped any more, not even by\n SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed."}], "id": "CVE-2026-99229", "lastModified": "2026-11-06T18:18:32.850", "metrics": {}, "published": "2026-11-02T16:17:47.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/340944e27b4bb218ed0ee66d0947ac70faefa05a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34f5a664c34d3cb62f6bec7f4156754594a7d25b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via stuck io_uring overflow list", "id": "2565265", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565265"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nio_uring/wait: don't spin on a stuck overflow list\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\nis stuck on the list if a single one is free, and then the ring holds\nless than cq_entries events. A single threaded application that asks\nfor as many events as the ring has entries never gets out of\nio_uring_enter().\n- Whether the ring is full is up to the CQ head, which the application\ncan write to. While one thread waits for events on an empty ring,\nanother one can move the head back so that the ring looks full and\nhave a CQE overflow. The waiter can't be stopped any more, not even by\nSIGKILL.\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed.", "A flaw was found in the Linux kernel's io_uring subsystem. A local attacker can cause a Denial of Service (DoS) by triggering an infinite loop when waiting for completion queue events. If entries on the overflow list cannot be flushed into the completion queue, the waiting kernel task continuously spins without processing signals or timeouts, resulting in an unkillable process that monopolizes system resources."], "name": "CVE-2026-99229", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99229\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99229\nhttps://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f\nhttps://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22\nhttps://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975\nhttps://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc"], "statement": "This vulnerability is rated Moderate rather than Important because exploitation requires local access and can only result in a denial of service condition without compromising data confidentiality or system integrity. An authenticated local user must be able to interact with the kernel's asynchronous I/O framework and create specialized completion queue configurations to trigger the hang. In enterprise installations where io_uring is restricted or not utilized by unprivileged accounts, exposure is significantly reduced. Because the spin condition prevents the affected task from receiving termination signals, the impact is confined to CPU consumption by the stuck process unless system resources become exhausted.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,bf1d2ed84b3162e3b0e0bb7018ac59147da6e975)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,a6cfc85c6bf9498aaf1978b503f9663635a1aa22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,4a89352edd8b3e20d1e1fb33f0fc297dd137149f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,c347691e5dc5481b2d6943c123619e04847fb0dc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,bf1d2ed84b3162e3b0e0bb7018ac59147da6e975)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,a6cfc85c6bf9498aaf1978b503f9663635a1aa22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,4a89352edd8b3e20d1e1fb33f0fc297dd137149f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3fcf19d592d5cb63eb209400b22055651e3c27d0,c347691e5dc5481b2d6943c123619e04847fb0dc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T17:45:12.194566+00:00", "updated": "2026-11-05T02:00:16.252596+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}