CVE-2026-99230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99230", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.402Z", "datePublished": "2026-11-02T16:06:37.984Z", "dateUpdated": "2026-11-06T17:15:11.543Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T17:15:11.543Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n RIP: 0010:io_futexv_complete+0x219/0x420\n Call Trace:\n tctx_task_work_run+0x804/0x950\n tctx_task_work+0x71/0xa0\n task_work_run+0x118/0x200\n\nLeave the node unhashed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/uring_cmd.c"], "versions": [{"version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "lessThan": "cc7f13d006fcefed9564bd79f135b51d344e9c77", "status": "affected", "versionType": "git"}, {"version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "lessThan": "2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707", "status": "affected", "versionType": "git"}, {"version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "lessThan": "685b49483200384d7f49d338af476e26e6824637", "status": "affected", "versionType": "git"}, {"version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "lessThan": "c4fe1024b2f3f40f8010591a0c0ad541e2883eda", "status": "affected", "versionType": "git"}, {"version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "lessThan": "4c83e39f4d1944d7146fd06094f2c8053238d55c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/uring_cmd.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"}, {"url": "https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707"}, {"url": "https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637"}, {"url": "https://git.kernel.org/stable/c/c4fe1024b2f3f40f8010591a0c0ad541e2883eda"}, {"url": "https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c"}], "title": "io_uring/cmd: don't leave list poison in ->hash_node", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/uring_cmd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc7f13d006fcefed9564bd79f135b51d344e9c77", "status": "affected", "version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "versionType": "git"}, {"lessThan": "2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707", "status": "affected", "version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "versionType": "git"}, {"lessThan": "685b49483200384d7f49d338af476e26e6824637", "status": "affected", "version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "versionType": "git"}, {"lessThan": "c4fe1024b2f3f40f8010591a0c0ad541e2883eda", "status": "affected", "version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "versionType": "git"}, {"lessThan": "4c83e39f4d1944d7146fd06094f2c8053238d55c", "status": "affected", "version": "93b8cc60c37b9d17732b7a297e5dca29b50a990d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/uring_cmd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n RIP: 0010:io_futexv_complete+0x219/0x420\n Call Trace:\n tctx_task_work_run+0x804/0x950\n tctx_task_work+0x71/0xa0\n task_work_run+0x118/0x200\n\nLeave the node unhashed."}], "id": "CVE-2026-99230", "lastModified": "2026-11-06T18:18:33.013", "metrics": {}, "published": "2026-11-02T16:17:47.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4fe1024b2f3f40f8010591a0c0ad541e2883eda"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via uninitialized list node in io_uring", "id": "2565267", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565267"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nio_uring/cmd: don't leave list poison in ->hash_node\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\nOops: general protection fault, probably for non-canonical address\nKASAN: maybe wild-memory-access in range [0xdead000000000120-...]\nRIP: 0010:io_futexv_complete+0x219/0x420\nCall Trace:\ntctx_task_work_run+0x804/0x950\ntctx_task_work+0x71/0xa0\ntask_work_run+0x118/0x200\nLeave the node unhashed.", "A flaw was found in the Linux kernel's io_uring subsystem. When cancelable commands are removed, recycled request objects can retain stale list pointers instead of being cleanly reinitialized. A local attacker can trigger this issue by submitting specific asynchronous I/O requests, causing the kernel to dereference invalid memory. This flaw leads to a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-99230", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99230\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99230\nhttps://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707\nhttps://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637\nhttps://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"], "statement": "This vulnerability is classified as Moderate severity for Red Hat because successful exploitation requires local access and solely impacts system availability through an unexpected kernel crash. The issue stems from improperly reinitialized request tracking nodes within the kernel's io_uring asynchronous subsystem, causing invalid pointer dereferences when specific vectored operations interact with recycled commands. Exploitation cannot be triggered remotely and does not enable privilege escalation or data confidentiality loss, limiting the impact to a local denial of service.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,cc7f13d006fcefed9564bd79f135b51d344e9c77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,685b49483200384d7f49d338af476e26e6824637)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,cc7f13d006fcefed9564bd79f135b51d344e9c77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93b8cc60c37b9d17732b7a297e5dca29b50a990d,685b49483200384d7f49d338af476e26e6824637)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T18:15:14.382569+00:00", "updated": "2026-11-05T04:15:05.071166+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}